CyberShop ASP ShopDBTest.ASP Information Disclosure Vulnerability

Bugtraq ID:	8186
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 14 2003 12:00AM
Updated:	Jul 14 2003 12:00AM
Credit:	Discovery of this vulnerability has been credited to Dr`Ponidi <[email protected]>.
Vulnerable:	CyberShop ASP CyberShop ASP 6.0 Fx
Not Vulnerable:

CyberShop ASP ShopDBTest.ASP Information Disclosure Vulnerability

CyberShop ASP is e-commerce software that is implemented in ASP.

CyberShop ASP may not adequately protect debugging scripts, this may provide for the disclosure of potentially sensitive information.

It has been reported that a remote attacker may access CyberShop database debugging scripts, on a default install, without requiring prior authentication.

This issue may be exploited by a malicious attacker to disclose potentially sensitive information that is contained in the database used by CyberShop ASP.

CyberShop ASP ShopDBTest.ASP Information Disclosure Vulnerability

There is no exploit required.

CyberShop ASP ShopDBTest.ASP Information Disclosure Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

CyberShop ASP ShopDBTest.ASP Information Disclosure Vulnerability

References:

• CyberShop ASP Homepage (CyberShop ASP)