medium5.0Public exploit code
CVE-2005-2330
Directory traversal vulnerability in extras/update.php in osCommerce 2.2 allows remote attackers to read arbitrary files via (1) ..
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- osCommerce 2.2 - 'update.php' Information Disclosure2005-07-18 · webapps · php · Verified
Impact
Directory traversal vulnerability in extras/update.php in osCommerce 2.2 allows remote attackers to read arbitrary files via (1) .. sequences or (2) a full pathname in the readme_file parameter.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Oscommerce | Oscommerce | Version 2.2_ms2 |
References
- NVD record
- CVE.org record
- http://retrogod.altervista.org/oscommerce_22_adv.html
- http://securitytracker.com/id?1015944
- http://sourceforge.net/mailarchive/message.php?msg_id=12318248
- http://www.oscommerce.com/community/bugs%2C2835
- http://www.osvdb.org/18249
- http://www.securityfocus.com/archive/1/431012
- http://www.securityfocus.com/archive/1/431068
- http://www.securityfocus.com/bid/14294
- https://exchange.xforce.ibmcloud.com/vulnerabilities/25861
- http://retrogod.altervista.org/oscommerce_22_adv.html
- http://securitytracker.com/id?1015944
- http://sourceforge.net/mailarchive/message.php?msg_id=12318248
- http://www.oscommerce.com/community/bugs%2C2835
- http://www.osvdb.org/18249
- http://www.securityfocus.com/archive/1/431012
- http://www.securityfocus.com/archive/1/431068
- http://www.securityfocus.com/bid/14294
- https://exchange.xforce.ibmcloud.com/vulnerabilities/25861