CVE-2013-3651: Code Injection
Published Jun 29, 2013
·Updated
LOCKON EC-CUBE 2.11.2 through 2.12.4 allows remote attackers to conduct unspecified PHP code-injection attacks via a crafted string, related to data/class/SCCheckError.php and data/class/SCFormParam.php.
Affected Software
9 affected components
LOCKON EC-CUBE=2.11.2
LOCKON EC-CUBE=2.11.3
LOCKON EC-CUBE=2.11.4
LOCKON EC-CUBE=2.11.5
LOCKON EC-CUBE=2.12.0
LOCKON EC-CUBE=2.12.1
LOCKON EC-CUBE=2.12.2
LOCKON EC-CUBE=2.12.3
LOCKON EC-CUBE=2.12.4
Event History
Jun 29, 2013
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2013-3651?
CVE-2013-3651 is considered a high severity vulnerability due to the potential for remote code execution.
2
How do I fix CVE-2013-3651?
To fix CVE-2013-3651, upgrade your LOCKON EC-CUBE installation to version 2.12.5 or later.
3
What versions of LOCKON EC-CUBE are affected by CVE-2013-3651?
CVE-2013-3651 affects LOCKON EC-CUBE versions from 2.11.2 to 2.12.4.
4
What types of attacks can occur due to CVE-2013-3651?
CVE-2013-3651 allows remote attackers to conduct PHP code-injection attacks, potentially compromising the server.
5
Is there a known exploit for CVE-2013-3651?
Yes, CVE-2013-3651 is known to be exploitable, which emphasizes the importance of applying the necessary patches immediately.