Dfd_cart

Quality :
Bingza has initiated some vulnerabilities in DFD Cart, which can be exploited by malicious citizenry to discover sensitive info or to compromise a vulnerable system. Stimulant passed to the "set_depth" parameter in product.control.config.php, customer.area/customer.browse.li st.php, and customer.area/customer.browse.se arch.php is not properly verified before existence used to include files. That can be exploited to include arbitrary files from territorial or outside resources. All scripts are located in the app.lib/product.control/core.php directory. Successful using wishs this "register_globals" is enabled. The vulnerabilities are watchered in adaptation 1.1.4. Unrelated versions may furthermore be affected.
Result :
Updating to adaptation 1.1.7.
Provided and/or shaped by :
Bingza
Changelog :
2007-09-28: Adhered CVE reference. 2007-10-02: Hitched CVE reference. 2007-10-08: Updated "solution" section.
Pilot Advisory :
http://milw0rm.com/exploits/4451


Please note: The info this that Secunia Advisory is based on arrives from a tierce lot unless stated otherwise.

Secunia collects, validates, and verifies all exposure dope loomed by warranter query groups, vendors, and others.

Stake Feedback to Secunia
If you stimulate new info regarding that Secunia advisory or a crossroad in our database, please carry it to us exploitation either our