Secunia

SoulBlack Security Research has reported a security issue in Cookie Cart, which can be exploited by malicious people to disclose system and sensitive information.

The problem is caused due to database information being stored inside the web root. This can be exploited to disclose order notifications and encrypted passwords.

NOTE: The order notification list can be disclosed via the "testmy.cgi" script.

Solution
Restrict access to the database directories and the "testmy.cgi" script.

Provided and/or discovered by
SoulBlack Security Research

Changelog
Further details available in Customer Area

Original Advisory
http://www.soulblack.com.ar/repo/papers/cookiec_advisory.txt

Deep Links
Links available in Customer Area