CVE-2006-3757: Medium severity Zen Cart Zen Cart vulnerability

Published Jul 21, 2006

Updated

index.php in Zen Cart 1.3.0.2 allows remote attackers to obtain sensitive information via empty (1) GET[], (2) SESSION[], (3) POST[], (4) COOKIE[], or (5) SESSION[] array parameters, which reveals the installation path in an error message. NOTE: this issue might be resultant from a global overwrite vulnerability.

Affected Software

1 affected component

Zen Cart Zen Cart=1.3.0.2

Event History

Jul 21, 2006

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2006-3757?

CVE-2006-3757 is categorized as a moderate severity vulnerability due to information disclosure risks.

How do I fix CVE-2006-3757?

To fix CVE-2006-3757, it's recommended to upgrade Zen Cart to a version later than 1.3.0.2 that addresses this issue.

What are the potential impacts of CVE-2006-3757?

The potential impacts of CVE-2006-3757 include unauthorized access to sensitive installation path information.

Is CVE-2006-3757 still a relevant vulnerability?

While CVE-2006-3757 was reported in 2006, it remains relevant for systems that still use Zen Cart 1.3.0.2 without updates.

What type of attacks are possible with CVE-2006-3757?

CVE-2006-3757 allows remote attackers to execute information disclosure attacks by exploiting empty array parameters.