CVE-2006-6390
published 2006-12-08CVE-2006-6390: Multiple directory traversal vulnerabilities in Open Solution Quick.Cart 2.0, when register_globals is enabled and magic_quotes_gpc is disabled, allow remote…
PriorityP334medium6.8CVSS 2.0
AVNACMAuNCPIPAP
EXPLOIT
EPSS
2.02%
78.6th percentile
Multiple directory traversal vulnerabilities in Open Solution Quick.Cart 2.0, when register_globals is enabled and magic_quotes_gpc is disabled, allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the config[db_type] parameter to (1) categories.php, (2) couriers.php, (3) orders.php, and (4) products.php in actions_admin/; and (5) orders.php and (6) products.php in actions_client/; as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by one of these PHP scripts.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| open_solution | quick.cart | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No writeups or analysis indexed.
http://secunia.com/advisories/23168http://www.securityfocus.com/bid/21411http://www.vupen.com/english/advisories/2006/4835https://exchange.xforce.ibmcloud.com/vulnerabilities/30698https://www.exploit-db.com/exploits/2889http://secunia.com/advisories/23168http://www.securityfocus.com/bid/21411http://www.vupen.com/english/advisories/2006/4835https://exchange.xforce.ibmcloud.com/vulnerabilities/30698https://www.exploit-db.com/exploits/2889
2006-12-08
Published