CVE-2008-0158: Path Traversal

Published Jan 9, 2008

Updated

Directory traversal vulnerability in index.php in Shop-Script 2.0 and possibly other versions allows remote attackers to read arbitrary files via a .. (dot dot) in the auxpage parameter.

Affected Software

1 affected component

Shop-Script Shop-Script=2.0

Event History

Jan 9, 2008

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

Who can exploit this issue?

A remote attacker can exploit it because the listed vector is network-accessible and requires no authentication. The vulnerable endpoint is index.php with the aux_page parameter.

What does successful exploitation allow?

Successful exploitation allows an attacker to read arbitrary files by supplying directory-traversal sequences such as .. in the aux_page parameter. The available impact information indicates confidentiality exposure, with no stated integrity or availability impact.

Which versions should be investigated?

Shop-Script 2.0 is identified as affected. The description notes that other versions may also be affected, so deployments outside version 2.0 should be assessed rather than assumed safe.

CVE-2008-0158: Path Traversal

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What does successful exploitation allow?

Which versions should be investigated?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What does successful exploitation allow?

Which versions should be investigated?