bugtraq - Re: OpenCart 1.5.6.4 Directory Traversal Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20140601074041.GC5901@kludge.henri.nerv.fi>
Date: Sun, 1 Jun 2014 10:40:41 +0300
From: Henri Salo <henri@...v.fi>
To: iedb.team@...il.com
Cc: bugtraq@...urityfocus.com, security@...ncart.com
Subject: Re: OpenCart 1.5.6.4 Directory Traversal Vulnerability

On Thu, May 29, 2014 at 01:40:54PM +0000, iedb.team@...il.com wrote:
> http://iedb.ir/up/imagef-140139785162051-jpg.html
> #  Archive Exploit = http://www.iedb.ir/exploits-1731.html

I was unable to reproduce this issue in OpenCart version 1.5.6.4. From the
picture this seems to be path disclosure issue or could you provide working
proof-of-concept to exploit directory traversal issue? Did you report this to
vendor? Does this have CVE? Did you use any plugins or themes (like Shoppica) or
did you have OpenCart as module/extension in some other software?

Sadly at the moment this looks like yet another fake/false from iedb.

---
Henri Salo

Download attachment "signature.asc" of type "application/pgp-signature" (199 bytes)