CVE-2012-0865

EPSS 3.0%

Multiple open redirect vulnerabilities in CubeCart 3.0.20 and earlier allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the (1) r parameter to switch.php or (2) goto parameter to admin/login.php.

Affected products

n/a · n/a

public PoCs found — 3

exploitdbwww.exploit-db.com/exploits/36686unverified exploitdbwww.exploit-db.com/exploits/36687unverified exploitdbwww.exploit-db.com/exploits/36685unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://archives.neohapsis.com/archives/bugtraq/2012-02/0058.html http://osvdb.org/79140 http://osvdb.org/79141 http://www.openwall.com/lists/oss-security/2012/02/12/4 http://www.openwall.com/lists/oss-security/2012/02/13/5 http://www.openwall.com/lists/oss-security/2012/02/18/1 http://www.securityfocus.com/bid/51966 http://www.securitytracker.com/id?1026711 http://yehg.net/lab/pr0js/advisories/%5Bcubecart_3.0.20_3.0.x%5D_open_url_redirection