CVE-2006-4527: Low severity cubecart vulnerability

Published Sep 1, 2006

Updated

includes/content/gateway.inc.php in CubeCart 3.0.12 and earlier, when magicquotesgpc is disabled, uses an insufficiently restrictive regular expression to validate the gateway parameter, which allows remote attackers to conduct PHP remote file inclusion attacks.

Affected Software

1 affected component

Devellion CubeCart=3.0.12

Event History

Sep 1, 2006

CVE Published

via MITRE·11:00 PM

Data Sourced

via MITRE·11:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2006-4527?

CVE-2006-4527 is considered a high-severity vulnerability due to the potential for remote file inclusion attacks.

How do I fix CVE-2006-4527?

To fix CVE-2006-4527, upgrade CubeCart to version 3.0.13 or later, where the vulnerability is addressed.

What systems are affected by CVE-2006-4527?

CVE-2006-4527 affects CubeCart version 3.0.12 and earlier.

What type of attack can CVE-2006-4527 facilitate?

CVE-2006-4527 can facilitate PHP remote file inclusion attacks, which allow attackers to execute malicious scripts on the server.

Is magic_quotes_gpc related to CVE-2006-4527?

Yes, CVE-2006-4527 is specifically an issue when magic_quotes_gpc is disabled, leading to improper input validation.