CVE-2005-0607
published 2005-05-02CVE-2005-0607: CubeCart 2.0.0 through 2.0.5 allows remote attackers to determine the full path of the server via direct calls without parameters to (1) information.php, (2)…
PriorityP413medium5CVSS 2.0
AVNACLAuNCPINAN
EPSS
1.43%
69.6th percentile
CubeCart 2.0.0 through 2.0.5 allows remote attackers to determine the full path of the server via direct calls without parameters to (1) information.php, (2) language.php, (3) list_docs.php, (4) popular_prod.php, (5) sale.php, (6) subfooter.inc.php, (7) subheader.inc.php, (8) cat_navi.php, or (9) check_sum.php, which reveals the path in a PHP error message.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| devellion | cubecart | — | — |
| devellion | cubecart | — | — |
| devellion | cubecart | — | — |
| devellion | cubecart | — | — |
| devellion | cubecart | — | — |
| devellion | cubecart | — | — |
| devellion | cubecart | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-mxq7-q7x8-w86q: CubeCart 2
ghsa_unreviewed·2022-05-01
CVE-2005-0607 [MEDIUM] GHSA-mxq7-q7x8-w86q: CubeCart 2
CubeCart 2.0.0 through 2.0.5 allows remote attackers to determine the full path of the server via direct calls without parameters to (1) information.php, (2) language.php, (3) list_docs.php, (4) popular_prod.php, (5) sale.php, (6) subfooter.inc.php, (7) subheader.inc.php, (8) cat_navi.php, or (9) check_sum.php, which reveals the path in a PHP error message.
GHSA
GHSA-pfhq-6vxc-8h4h: Devellion CubeCart 2
ghsa_unreviewed·2022-05-01·CVSS 5.0
CVE-2006-5109 [MEDIUM] GHSA-pfhq-6vxc-8h4h: Devellion CubeCart 2
Devellion CubeCart 2.0.x allows remote attackers to obtain sensitive information via a direct request for (1) link_navi.php or (2) spotlight.php, which reveals the path in various error messages. NOTE: the information.php, language.php, list_docs.php, popular_prod.php, sale.php, check_sum.php, and cat_navi.php vectors are already covered by CVE-2005-0607.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://lostmon.blogspot.com/2005/02/cubecart-20x-multiple-variable-xss.htmlhttp://securitytracker.com/id?1013304http://www.cubecart.com/site/forums/index.php?showtopic=6032https://exchange.xforce.ibmcloud.com/vulnerabilities/20638http://lostmon.blogspot.com/2005/02/cubecart-20x-multiple-variable-xss.htmlhttp://securitytracker.com/id?1013304http://www.cubecart.com/site/forums/index.php?showtopic=6032https://exchange.xforce.ibmcloud.com/vulnerabilities/20638
2005-05-02
Published