Detections
Analytics

StockMan Shopping Cart shop.plx page Parameter Arbitrary Command Execution

high Nessus Plugin ID 11569

Language:

Synopsis

The remote host is vulnerable to authentication bypass.

Description

The remote host is running the StockMan shopping cart.

According to the version number of the CGI shop.plx, there is a flaw in this installation that could allow an attacker to execute arbitrary commands on this host, and which could also allow him to obtain your list of customers or their credit card number.

Solution

Upgrade to StockMan Shopping Cart Version 7.9 or newer

Plugin Details

Severity: High

ID: 11569

File Name: stockman_shopping_cart_cmd_exec.nasl

Version: 1.19

Type: remote

Family: CGI abuses

Published: 5/5/2003

Updated: 1/19/2021

Supported Sensors: Nessus

Risk Information

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

Excluded KB Items: Settings/disable_cgi_scanning

Exploit Available: true

Exploit Ease: No exploit is required

Reference Information

BID: 7485