CommerceSQL Shopping Cart index.cgi Directory Traversal Vulnerability

Bugtraq ID:	9094
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 24 2003 12:00AM
Updated:	Nov 24 2003 12:00AM
Credit:	The disclosure of this issue has been credited to Mariusz Ciesla <[email protected]>.
Vulnerable:	CommerceSQL CommerceSQL Shopping Cart 2.2
Not Vulnerable:

CommerceSQL Shopping Cart index.cgi Directory Traversal Vulnerability

It has been reported that CommerceSQL may be prone to a directory traversal vulnerability that may allow an attacker to gain access to sensitive information. The issue presents itself due to insufficient sanitization of user-supplied input. An attacker may traverse outside the server root directory by using '../' character sequences.

CommerceSQL Shopping Cart index.cgi Directory Traversal Vulnerability

The following proof of concept has been provided;

index.cgi?page=../../../../../../../../etc/passwd

CommerceSQL Shopping Cart index.cgi Directory Traversal Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

CommerceSQL Shopping Cart index.cgi Directory Traversal Vulnerability

References:

• CommerceSQL Product Page (CommerceSQL.com)
  
• [CommerceSQL] Remote File Read Vulnerability (Mariusz Ciesla )