CVE-2012-0865
published 2012-02-21CVE-2012-0865: Multiple open redirect vulnerabilities in CubeCart 3.0.20 and earlier allow remote attackers to redirect users to arbitrary web sites and conduct phishing…
PriorityP426medium5.8CVSS 2.0
AVNACMAuNCPIPAN
EXPLOIT
EPSS
2.93%
85.3th percentile
Multiple open redirect vulnerabilities in CubeCart 3.0.20 and earlier allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the (1) r parameter to switch.php or (2) goto parameter to admin/login.php.
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cubecart | cubecart | <= 3.0.20 | — |
| cubecart | cubecart | — | — |
| cubecart | cubecart | — | — |
| cubecart | cubecart | — | — |
| cubecart | cubecart | — | — |
| cubecart | cubecart | — | — |
| cubecart | cubecart | — | — |
| cubecart | cubecart | — | — |
| cubecart | cubecart | — | — |
| cubecart | cubecart | — | — |
| cubecart | cubecart | — | — |
| cubecart | cubecart | — | — |
| cubecart | cubecart | — | — |
| cubecart | cubecart | — | — |
| cubecart | cubecart | — | — |
| cubecart | cubecart | — | — |
| cubecart | cubecart | — | — |
| cubecart | cubecart | — | — |
| cubecart | cubecart | — | — |
| cubecart | cubecart | — | — |
| cubecart | cubecart | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
CubeCart 3.0.20 - 'switch.php?r' Arbitrary Site Redirect
exploitdb·2012-02-10
CVE-2012-0865 CubeCart 3.0.20 - 'switch.php?r' Arbitrary Site Redirect
CubeCart 3.0.20 - 'switch.php?r' Arbitrary Site Redirect
---
source: https://www.securityfocus.com/bid/51966/info
CubeCart is prone to a URI-redirection vulnerabilities because the application fails to properly sanitize user-supplied input.
A successful exploit may aid in phishing attacks; other attacks are possible.
CubeCart 3.0.20 is vulnerable; other versions may also be affected.
http://www.example.com/cube3.0.20/switch.php?r=//yehg.net/&lang=es
Exploit-DB
CubeCart 3.0.20 - Multiple Script 'redir' Arbitrary Site Redirects
exploitdb·2012-02-10
CVE-2012-0865 CubeCart 3.0.20 - Multiple Script 'redir' Arbitrary Site Redirects
CubeCart 3.0.20 - Multiple Script 'redir' Arbitrary Site Redirects
---
source: https://www.securityfocus.com/bid/51966/info
CubeCart is prone to a URI-redirection vulnerabilities because the application fails to properly sanitize user-supplied input.
A successful exploit may aid in phishing attacks; other attacks are possible.
CubeCart 3.0.20 is vulnerable; other versions may also be affected.
http://www.example.com/cube/index.php?act=login&redir=Ly95ZWhnLm5ldC8%3D
http://www.example.com/cube/cart.php?act=reg&redir=L2N1YmUvaW5kZXgucGhwP2FjdD1sb2dpbg%3D%3D
Exploit-DB
CubeCart 3.0.20 - '/admin/login.php?goto' Arbitrary Site Redirect
exploitdb·2012-02-10
CVE-2012-0865 CubeCart 3.0.20 - '/admin/login.php?goto' Arbitrary Site Redirect
CubeCart 3.0.20 - '/admin/login.php?goto' Arbitrary Site Redirect
---
source: https://www.securityfocus.com/bid/51966/info
CubeCart is prone to a URI-redirection vulnerabilities because the application fails to properly sanitize user-supplied input.
A successful exploit may aid in phishing attacks; other attacks are possible.
CubeCart 3.0.20 is vulnerable; other versions may also be affected.
http://www.example.com/cube3.0.20/admin/login.php?goto=//yehg.net
No writeups or analysis indexed.
http://archives.neohapsis.com/archives/bugtraq/2012-02/0058.htmlhttp://osvdb.org/79140http://osvdb.org/79141http://www.openwall.com/lists/oss-security/2012/02/12/4http://www.openwall.com/lists/oss-security/2012/02/13/5http://www.openwall.com/lists/oss-security/2012/02/18/1http://www.securityfocus.com/bid/51966http://www.securitytracker.com/id?1026711http://yehg.net/lab/pr0js/advisories/%5Bcubecart_3.0.20_3.0.x%5D_open_url_redirectionhttp://archives.neohapsis.com/archives/bugtraq/2012-02/0058.htmlhttp://osvdb.org/79140http://osvdb.org/79141http://www.openwall.com/lists/oss-security/2012/02/12/4http://www.openwall.com/lists/oss-security/2012/02/13/5http://www.openwall.com/lists/oss-security/2012/02/18/1http://www.securityfocus.com/bid/51966http://www.securitytracker.com/id?1026711http://yehg.net/lab/pr0js/advisories/%5Bcubecart_3.0.20_3.0.x%5D_open_url_redirection
2012-02-21
Published