EC-CUBE CVE-2013-3654 Multiple Directory Traversal Vulnerabilities

Bugtraq ID:	60850
Class:	Input Validation Error
CVE:	CVE-2013-3654
Remote:	Yes
Local:	No
Published:	Jun 27 2013 12:00AM
Updated:	Jun 27 2013 12:00AM
Credit:	System Friend, lnc
Vulnerable:	EC-CUBE EC-CUBE 2.12.4 EC-CUBE EC-CUBE 2.12.3 EC-CUBE EC-CUBE 2.12.2 EC-CUBE EC-CUBE 2.12.1 EC-CUBE EC-CUBE 2.12 EC-CUBE EC-CUBE 2.12.4en EC-CUBE EC-CUBE 2.12.3enP2 EC-CUBE EC-CUBE 2.12.3enP1 EC-CUBE EC-CUBE 2.12.3en
Not Vulnerable:

EC-CUBE CVE-2013-3654 Multiple Directory Traversal Vulnerabilities

EC-CUBE is prone to multiple directory-traversal vulnerabilities because it fails to properly sanitize user-supplied input.

Exploiting these issues may allow an attacker to obtain sensitive information that could aid in further attacks.

The following versions are vulnerable:

EC-CUBE 2.12.0
EC-CUBE 2.12.1
EC-CUBE 2.12.2
EC-CUBE 2.12.3
EC-CUBE 2.12.3en
EC-CUBE 2.12.3enP1
EC-CUBE 2.12.3enP2
EC-CUBE 2.12.4
EC-CUBE 2.12.4en

EC-CUBE CVE-2013-3654 Multiple Directory Traversal Vulnerabilities

References:

• Directory Traversal Vulnerability (EC-CUBE)
  
• EC-CUBE Homepage (LOCKON CO. LTD.)
  
• JVNDB-2013-000065 EC-CUBE vulnerable to directory traversal (IPA)
  
• JVN#04161229 EC-CUBE vulnerable to directory traversal (JPCERT/CC and IPA)