CVE-2005-3997
Zen Cart 1.2.6d and earlier, under certain PHP configurations, allows remote attackers to obtain sensitive information via direct requests to files in the admin/includes directory, including (1) graphs/banner_daily.php, (2) graphs/banner_infobox.php,…
Does this matter?
Lower severity and a low EPSS score (1.98%). Track it; it rarely justifies an emergency change on its own.
Description
Zen Cart 1.2.6d and earlier, under certain PHP configurations, allows remote attackers to obtain sensitive information via direct requests to files in the admin/includes directory, including (1) graphs/banner_daily.php, (2) graphs/banner_infobox.php, (3) graphs/banner_yearly.php, (4) graphs/banner_monthly.php, (5) application_bottom.php, (6) attributes_preview.php, (7) modules/category_product_listing.php, (8) modules/copy_to_confirm.php, (9) modules/delete_product_confirm.php, and (10) modules/move_product_confirm.php, which leaks the web server path in the resulting error message.
- CVSS 2.0
- 2.6 LOWAV:N/AC:H/Au:N/C:P/I:N/A:N
- EPSS
- 1.98% probability · 79th percentile
- CISA KEV
- Not listed
- Affected
- zen cart/zen cart
- Source
- cve@mitre.org
References
- http://rgod.altervista.org/zencart_126d_xpl.html
- http://secunia.com/advisories/17869
- http://www.osvdb.org/22866
- http://www.osvdb.org/22867
- http://www.osvdb.org/22868
- http://www.osvdb.org/22869
- http://www.osvdb.org/22870
- http://www.osvdb.org/22871
- http://www.osvdb.org/22872
- http://www.osvdb.org/22873
- http://www.osvdb.org/22874
- http://www.osvdb.org/22875
- http://www.securityfocus.com/archive/1/418517/100/0/threaded
- http://www.securityfocus.com/archive/1/418995/100/0/threaded
- http://www.vupen.com/english/advisories/2005/2728
- http://rgod.altervista.org/zencart_126d_xpl.html
- http://secunia.com/advisories/17869
- http://www.osvdb.org/22866
- http://www.osvdb.org/22867
- http://www.osvdb.org/22868
- http://www.osvdb.org/22869
- http://www.osvdb.org/22870
- http://www.osvdb.org/22871
- http://www.osvdb.org/22872
- http://www.osvdb.org/22873
- http://www.osvdb.org/22874
- http://www.osvdb.org/22875
- http://www.securityfocus.com/archive/1/418517/100/0/threaded
- http://www.securityfocus.com/archive/1/418995/100/0/threaded
- http://www.vupen.com/english/advisories/2005/2728
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.