high7.5Public exploit code
CVE-2006-4904
Dynamic variable evaluation vulnerability in cmpi.php in Qualiteam X-Cart 4.1.3 and earlier allows remote attackers to overwrite arbitrary program variables an…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- X-Cart < 4.1.3 - Arbitrary Variable Overwrite2016-08-18 · webapps · php
Impact
Dynamic variable evaluation vulnerability in cmpi.php in Qualiteam X-Cart 4.1.3 and earlier allows remote attackers to overwrite arbitrary program variables and execute arbitrary PHP code, as demonstrated by PHP remote file inclusion via the xcart_dir parameter.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Qualiteam | X-Cart | through 4.1.3 |
References
- NVD record
- CVE.org record
- http://secunia.com/advisories/22005
- http://www.gulftech.org/?node=research&article_id=00113-09182006&
- http://www.securityfocus.com/bid/20108
- http://www.vupen.com/english/advisories/2006/3692
- https://exchange.xforce.ibmcloud.com/vulnerabilities/29005
- http://secunia.com/advisories/22005
- http://www.gulftech.org/?node=research&article_id=00113-09182006&
- http://www.securityfocus.com/bid/20108
- http://www.vupen.com/english/advisories/2006/3692
- https://exchange.xforce.ibmcloud.com/vulnerabilities/29005