vendor:
CaupoShop Pro
by:
Rami Salama
7.5
CVSS
HIGH
Local File Include
98
CWE
Product Name: CaupoShop Pro
Affected Version From: 2.x
Affected Version To: 3.7
Patch Exists: NO
Related CWE: N/A
CPE: a:caupo:cauposhop_pro
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2011
CaupoShop Pro (2.x/ <= 3.70) Local File Include Vulnerability
CaupoShop Pro (2.x/ <= 3.70) is vulnerable to a Local File Include vulnerability. This vulnerability allows an attacker to include a local file, usually through a script on the web server. An attacker can exploit this vulnerability by manipulating the 'template' parameter in a malicious URL request to the vulnerable CaupoShop Pro application. This can allow an attacker to view sensitive files on the web server, such as configuration files containing database usernames and passwords.
Mitigation:
To mitigate this vulnerability, ensure that user input is properly sanitized and validated. Additionally, ensure that the web server is configured to deny access to sensitive files.
