CVE-2005-3997 - Secunia Advisories - Vulnerability Information

CVE Reference: CVE-2005-3997
NOTE: The text on this page is written by CVE MITRE and reflects neither the opinions of Secunia or the results of our research. All data on this page is written and maintained by CVE MITRE.

Original Page at CVE MITRE: CVE-2005-3997

Description: Zen Cart 1.2.6d and earlier, under certain PHP configurations, allows remote attackers to obtain sensitive information via direct requests to files in the admin/includes directory, including (1) graphs/banner_daily.php, (2) graphs/banner_infobox.php, (3) graphs/banner_yearly.php, (4) graphs/banner_monthly.php, (5) application_bottom.php, (6) attributes_preview.php, (7) modules/category_product_listing.php, (8) modules/copy_to_confirm.php, (9) modules/delete_product_confirm.php, and (10) modules/move_product_confirm.php, which leaks the web server path in the resulting error message.

CVE Status: Candidate

References: SAID Secunia Advisory: SA17869 OSVDB 22869 22875 22874 22873 22871 22872 22870 22868 22867 22866 MISC http://rgod.altervista.org/zencart_126d_xpl.html BUGTRAQ http://www.securityfocus.com/archive/1/archive/1/418517/100/0/threaded http://www.securityfocus.com/archive/1/archive/1/418995/100/0/threaded

Return to the previous page.