CVE-2005-3997
First published: Mon Dec 05 2005(Updated: )
Zen Cart 1.2.6d and earlier, under certain PHP configurations, allows remote attackers to obtain sensitive information via direct requests to files in the admin/includes directory, including (1) graphs/banner_daily.php, (2) graphs/banner_infobox.php, (3) graphs/banner_yearly.php, (4) graphs/banner_monthly.php, (5) application_bottom.php, (6) attributes_preview.php, (7) modules/category_product_listing.php, (8) modules/copy_to_confirm.php, (9) modules/delete_product_confirm.php, and (10) modules/move_product_confirm.php, which leaks the web server path in the resulting error message.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Zen Cart | <=1.2.6d |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://rgod.altervista.org/zencart_126d_xpl.html
- http://secunia.com/advisories/17869
- http://www.osvdb.org/22866
- http://www.osvdb.org/22867
- http://www.osvdb.org/22868
- http://www.osvdb.org/22870
- http://www.osvdb.org/22871
- http://www.osvdb.org/22872
- http://www.osvdb.org/22873
- http://www.osvdb.org/22874
- http://www.osvdb.org/22875
- http://www.osvdb.org/22869
- http://www.vupen.com/english/advisories/2005/2728
- http://www.securityfocus.com/archive/1/418995/100/0/threaded
- http://www.securityfocus.com/archive/1/418517/100/0/threaded
Frequently Asked Questions
What is the severity of CVE-2005-3997?
CVE-2005-3997 has been classified as a medium-severity vulnerability, allowing information disclosure.
How do I fix CVE-2005-3997?
To fix CVE-2005-3997, upgrade Zen Cart to version 1.3.0 or later to ensure that sensitive files are not accessible.
What files are affected by CVE-2005-3997?
CVE-2005-3997 affects files in the admin/includes directory, such as graphs/banner_daily.php and others.
Who is impacted by CVE-2005-3997?
Users of Zen Cart versions 1.2.6d and earlier are primarily impacted by CVE-2005-3997.
Can CVE-2005-3997 lead to data breaches?
Yes, CVE-2005-3997 can potentially lead to unauthorized access to sensitive information, which may result in data breaches.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/severity
- agent/last-modified-date
- agent/references
- agent/author
- agent/event
- agent/description
- agent/first-publish-date
- agent/source
- agent/tags
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- agent/softwarecombine
- vendor/zen cart
- canonical/zen cart
- version/zen cart/1.2.6d