VulnerabilityModified
CVE-2008-6279
RakhiSoftware Price Comparison Script (aka Shopping Cart) allows remote attackers to obtain sensitive information via an invalid PHPSESSID cookie, which reveals the installation path in an error message.
HIGH 7.8EPSS 2.52%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.52%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
RakhiSoftware Price Comparison Script (aka Shopping Cart) allows remote attackers to obtain sensitive information via an invalid PHPSESSID cookie, which reveals the installation path in an error message.
- CVSS 2.0
- 7.8 HIGHAV:N/AC:L/Au:N/C:C/I:N/A:N
- EPSS
- 2.52% probability · 84th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200
- Affected
- rakhisoftware/rakhisoftware shopping cart
- Source
- cve@mitre.org
References
- http://osvdb.org/50325
- http://packetstormsecurity.com/0811-exploits/rakhi-sqlxssfpd.txtExploit
- http://secunia.com/advisories/32950Vendor Advisory
- http://www.securityfocus.com/bid/32563Exploit
- http://osvdb.org/50325
- http://packetstormsecurity.com/0811-exploits/rakhi-sqlxssfpd.txtExploit
- http://secunia.com/advisories/32950Vendor Advisory
- http://www.securityfocus.com/bid/32563Exploit
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.