Cactusoft CactuShop Lite Remote Arbitrary File Deletion Backdoor Vulnerability

Bugtraq ID:	9589
Class:	Unknown
CVE:	CVE-2004-0260
Remote:	Yes
Local:	No
Published:	Feb 06 2004 12:00AM
Updated:	Jul 12 2009 02:06AM
Credit:	The disclosure of this issue has been credited to Nick Gudov <[email protected]>.
Vulnerable:	CactuSoft CactuShop Lite 5.0
Not Vulnerable:

Cactusoft CactuShop Lite Remote Arbitrary File Deletion Backdoor Vulnerability

It has been reported that Cactusoft CactuShop Lite may be prone to a remote arbitrary file deletion vulnerability that may allow remote attackers to delete arbitrary files on a vulnerable system. The problem is reported to be caused by user-supplied data passed via the 'strEmailAddress' variable of the AddToMailingList() function. This problem is reported to be a backdoor that allows attackers to delete arbitrary files from a vulnerable system leading to a denial of service issue.

It should be noted that Cactusoft CactuShop Lite is demo software and not intended by the vendor for commercial use.

Cactusoft CactuShop Lite version 5.0 has been reported to be prone to this issue.

Cactusoft CactuShop Lite Remote Arbitrary File Deletion Backdoor Vulnerability

No exploit is required.

Cactusoft CactuShop Lite Remote Arbitrary File Deletion Backdoor Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Cactusoft CactuShop Lite Remote Arbitrary File Deletion Backdoor Vulnerability

References:

• CactuShop (CactuSoft)
  
• CactuSoft CactuShop 5.0 Lite shopping cart software backdoor (S-Quadra Security Research )