CVE-2005-4787
Turnkey Web Tools SunShop Shopping Cart allows remote attackers to obtain sensitive information via a phpinfo action to (1) index.php, (2)…
Published 20 y ago · modified 4 mo ago · JSON
Summary
Turnkey Web Tools SunShop Shopping Cart allows remote attackers to obtain sensitive information via a phpinfo action to (1) index.php, (2) admin/index.php, and (3) admin/adminindex.php, which executes the PHP phpinfo function. NOTE: The vendor has disputed this issue, saying that "Having this in the code makes it easier for us to troubleshoot when issues arise on individual carts. For someone to have a script to do this type of search would require that they know where your shop is actually located. I dont think it really can be construde [sic] as a security issue.
Exploit prediction (EPSS)
1.55% probability of exploitation in the next 30 days, higher than 75% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
References
- secunia.com /advisories/17832 · third-party-advisory, x_refsource_SECUNIA, x_transferred
- turnkeywebtools.com /forum/showpost.php?p=9874&postcount=6 · x_refsource_MISC, x_transferred
- turnkeywebtools.com /forum/showthread.php?t=2384 · x_refsource_CONFIRM, x_transferred
Sources
- CVE List: CVE-2005-4787
- NVD: CVE-2005-4787
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.