Detections
Analytics
Comersus Cart Multiple Input Validation Vulnerabilities (SQLi, XSS)
high Nessus Plugin ID 14183
Language:
Synopsis
The web application running on the remote host has multiple vulnerabilities.Description
The remote host is running the Comersus Shopping Cart Software.There is a flaw in this interface that allows an attacker to log in as any user by using a SQL injection flaw in the code of comersus_backoffice_login.php.
An attacker may use this flaw to gain unauthorized access on this host, or to gain the control of the remote database.
In addition to this, the remote version of this software may be vulnerable to other issues (see BID 10674).
Solution
Upgrade to the latest version of the software.See Also
https://seclists.org/bugtraq/2004/Jul/71
Plugin Details
Severity: High
ID: 14183
File Name: comersus_sql_injection.nasl
Version: 1.25
Type: remote
Family: CGI abuses
Published: 8/2/2004
Updated: 1/19/2021
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.0
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 7.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
Vulnerability Information
Required KB Items: www/ASP
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Available: true
Exploit Ease: No exploit is required
Vulnerability Publication Date: 7/6/2004
Reference Information
CVE: CVE-2004-0681, CVE-2004-0682