Webscriptworld Web Shop Manager Remote Arbitrary Command Execution Vulnerability

Bugtraq ID:	5474
Class:	Input Validation Error
CVE:	CVE-2002-1461
Remote:	Yes
Local:	No
Published:	Aug 15 2002 12:00AM
Updated:	Jul 11 2009 03:56PM
Credit:	Vulnerability discovery credited to Tacettin Karadeniz <[email protected]>.
Vulnerable:	Webscriptworld Web Shop Manager 1.1
Not Vulnerable:

Webscriptworld Web Shop Manager Remote Arbitrary Command Execution Vulnerability

Web Shop Manager is a freely available, open source web store script. It is available for Unix, Linux, and Microsoft Windows operating systems.

Web Shop Manager does not sufficiently filter user-supplied input. Because of this, it is possible for a remote user to pass arbitrary commands through the script which will be executed in a shell on the local host. These commands would be executed with the privileges of the web server process.

Webscriptworld Web Shop Manager Remote Arbitrary Command Execution Vulnerability

This vulnerability may be exploited with a web browser.

Webscriptworld Web Shop Manager Remote Arbitrary Command Execution Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Webscriptworld Web Shop Manager Remote Arbitrary Command Execution Vulnerability

References:

• Web Shop Manager Homepage (Webscriptworld)