Alan Ward A-Cart Web Accessable Database File Vulnerability

Bugtraq ID:	5597
Class:	Configuration Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 30 2002 12:00AM
Updated:	Aug 30 2002 12:00AM
Credit:	Published by Tacettin Karadeniz <[email protected]>.
Vulnerable:	Alan Ward A-Cart 2.0
Not Vulnerable:

Alan Ward A-Cart Web Accessable Database File Vulnerability

Alan Ward's A-Cart is a web based shopping cart application. It is implemented in ASP, and designed for use with Microsoft Access under Microsoft Windows based servers.

A vulnerability has been reported in some versions of A-Cart. By default, the database file 'acart2_0.mdb' is stored within the web directory. Remote attackers may be able to download the database file through a HTTP request.

Alan Ward A-Cart Web Accessable Database File Vulnerability

No exploit is required.

Alan Ward A-Cart Web Accessable Database File Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Alan Ward A-Cart Web Accessable Database File Vulnerability

References:

• A-Cart Homepage (Alan Ward)
  
• Plaintext Vulnerability in Alan Ward Acart ()