CVE-2010-1589 Directory traversal vulnerability in shopsessionsubs.asp in Rocksalt International VP-ASP Shopping Cart 6.50 and earlier might allow remote attackers to determine the existence of arbitrary files via....
MediumCVSS 5.0
EPSS 1.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Directory traversal vulnerability in shopsessionsubs.asp in Rocksalt International VP-ASP Shopping Cart 6.50 and earlier might allow remote attackers to determine the existence of arbitrary files via directory traversal sequences in the client's DNS hostname (aka the REMOTE_HOST variable), related to the CookielessGenerateFilename and CookielessReadFile functions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| vpasp vp-asp shopping cart | <= 6.50 | No fix listed |
| vpasp vp-asp shopping cart | = 5.50 | No fix listed |
| vpasp vp-asp shopping cart | = 6.00 | No fix listed |
References
- 20100120 Insufficient User Input Validation in VP-ASP 6.50 Demo Code exploit mailing-list
- 61891 vdb-entry
- 38283 third-party-advisory vendor-advisory
- shoppingcart-remotehost-dir-traversal(55824) vdb-entry