QuikStore Shopping Cart Information Disclosure Vulnerability

vendor:

Shopping Cart

by:

SecurityFocus

2.6

CVSS

LOW

Information Disclosure

200

CWE

Product Name: Shopping Cart

Affected Version From: 2.12

Affected Version To: 2.12

Patch Exists: Unknown

Related CWE: N/A

CPE: quikstore

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2002

QuikStore Shopping Cart Information Disclosure Vulnerability

It has been reported that QuikStore Shopping Cart may be prone to an information disclosure vulnerability due to insufficient sanitization of user-supplied data through the 'store' parameter of the 'quikstore.cgi' script. An attacker may dislcose the installation path of a file by making a malformed request and passing a single quote "'" character to generate an error message. The error message is reported to contain sensitive information such as the installation path.

Mitigation:

Input validation should be used to ensure that user-supplied data is properly sanitized.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/9282/info

It has been reported that QuikStore Shopping Cart may be prone to an information disclosure vulnerability due to insufficient sanitization of user-supplied data through the 'store' parameter of the 'quikstore.cgi' script. An attacker may dislcose the installation path of a file by making a malformed request and passing a single quote "'" character to generate an error message. The error message is reported to contain sensitive information such as the installation path.

Specific vulnerable versions of the software were not identified in the report; therefore it is assumed that the current version QuikStore Shopping Cart v2.12 is vulnerable to this issue.

http://[target]/cgi-bin/quikstore.cgi?store='