CVE-2013-4702 Multiple directory traversal vulnerabilities in the doApiAction function in data/class/api/SC_Api_Operation.php in LOCKON EC-CUBE 2.12.0 through 2.12.5 on Windows allow remote attackers to read arbitr...
MediumCVSS 5.0
EPSS 2.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple directory traversal vulnerabilities in the doApiAction function in data/class/api/SC_Api_Operation.php in LOCKON EC-CUBE 2.12.0 through 2.12.5 on Windows allow remote attackers to read arbitrary files via vectors involving a (1) Operation, (2) Service, (3) Style, (4) Validate, or (5) Version value.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| lockon ec-cube | = 2.12.0 | No fix listed |
| lockon ec-cube | = 2.12.1 | No fix listed |
| lockon ec-cube | = 2.12.2 | No fix listed |
| lockon ec-cube | = 2.12.3 | No fix listed |
| lockon ec-cube | = 2.12.3en | No fix listed |
| lockon ec-cube | = 2.12.3enp1 | No fix listed |
| lockon ec-cube | = 2.12.3enp2 | No fix listed |
| lockon ec-cube | = 2.12.4 | No fix listed |
| lockon ec-cube | = 2.12.4en | No fix listed |
| lockon ec-cube | = 2.12.5 | No fix listed |
| lockon ec-cube | = 2.12.5en | No fix listed |
References
- JVN#15973066 third-party-advisory
- JVNDB-2013-000081 third-party-advisory
- 96756 vdb-entry
- svn.ec-cube.net exploit patch
- www.ec-cube.net
- www.ec-cube.net vendor-advisory