National Vulnerability Database (CVE-2000-1092)

National Cyber-Alert System Vulnerability Summary: CVE-2000-1092
Orirignal release date: 2001-01-09 Source: US-CERT/NIST ### Overview loadpage.cgi CGI program in EZshopper 3.0 and 2.0 allows remote attackers to list and read files in the EZshopper data directory by inserting a &quot;/&quot; in front of the target filename in the &quot;file&quot; parameter. ### Impact CVSS Severity: 3.3 (Low) Range: remote Authentication: input Impact Type: conf ### Reference to Advisories, Solutions, and Tools External Source: Security Focus Name: BID 2109 Hyperlink: http://www.securityfocus.com/bid/2109 External Source: BID Name: 2109 Hyperlink: http://online.securityfocus.com/bid/2109 External Source: XF Name: ezshopper-cgi-file-disclosure(5740) Hyperlink: http://xforce.iss.net/static/5740.php External Source: BUGTRAQ Name: amp Hyperlink: http://marc.theaimsgroup.com/?l=bugtraq& ### Vulnerable Software and Vendor EZShopper (Alex Heiphetz Group) Technical Details CVE Standard Vulnerability Entry: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-1092