Multiple geeeekShop Information Disclosure Vulnerabilities
BID:8380
Info
Multiple geeeekShop Information Disclosure Vulnerabilities
| Bugtraq ID: | 8380 |
| Class: | Failure to Handle Exceptional Conditions |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 09 2003 12:00AM |
| Updated: | Aug 09 2003 12:00AM |
| Credit: | Discovery of this vulnerability has been credited to G00db0y <[email protected]>. |
| Vulnerable: |
GEEEEKSHOP geeeekShop 1.4 |
| Not Vulnerable: | |
Discussion
Multiple geeeekShop Information Disclosure Vulnerabilities
geeeekShop is prone to multiple information disclosure vulnerabilities. Passing invalid data as URI parameters to geeeekShop scripts, will cause an error message to be displayed, which contains installation path information. Additionally it has been reported that a remote attacker may access site configuration scripts, which may lead to the disclosure of potentially sensitive information.
geeeekShop is prone to multiple information disclosure vulnerabilities. Passing invalid data as URI parameters to geeeekShop scripts, will cause an error message to be displayed, which contains installation path information. Additionally it has been reported that a remote attacker may access site configuration scripts, which may lead to the disclosure of potentially sensitive information.
Exploit / POC
Multiple geeeekShop Information Disclosure Vulnerabilities
The following proof of concept has been supplied:
http://www.example.com/shop/?category=xxxxxx&parent=0&page=x&/'
http://www.example.com/shop/php_files/site.config.php
The following proof of concept has been supplied:
http://www.example.com/shop/?category=xxxxxx&parent=0&page=x&/'
http://www.example.com/shop/php_files/site.config.php
Solution / Fix
Multiple geeeekShop Information Disclosure Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Multiple geeeekShop Information Disclosure Vulnerabilities
References:
References: