Extropia WebStore File Access Vulnerability

vendor:

WebStore

by:

SecurityFocus

7.5

CVSS

HIGH

File Access Vulnerability

CWE

Product Name: WebStore

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: N/A

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2002

Extropia WebStore File Access Vulnerability

Extropia WebStore is an e-commerce shopping cart application consisting of routines for error handling, order processing, encrypted mailing, frames, Javascript and VBscript. The routine web_store.cgi does not properly handle the $file_extension variable if null characters are used. For example if the following URL was requested, the file in question would not be delivered to the user: http://target/cgi-bin/Web_Store/web_store.cgi?page=../../../path/filename.ext However, by using the escaped character “%00”, the requested file would be accessed successfully: http://target/cgi-bin/Web_Store/web_store.cgi?page=../../../path/filename%00ext Successful exploitation could lead to a remote intruder gaining read access to any known file.

Mitigation:

Ensure that the web_store.cgi script is properly configured to handle null characters.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/1774/info

Extropia WebStore is an e-commerce shopping cart application consisting of routines for error handling, order processing, encrypted mailing, frames, Javascript and VBscript.

The routine web_store.cgi does not properly handle the $file_extension variable if null characters are used.

For example if the following URL was requested, the file in question would not be delivered to the user:

http://target/cgi-bin/Web_Store/web_store.cgi?page=../../../path/filename.ext

However, by using the escaped character "%00", the requested file would be accessed successfully:

http://target/cgi-bin/Web_Store/web_store.cgi?page=../../../path/filename%00ext

Successful exploitation could lead to a remote intruder gaining read access to any known file.