National Vulnerability Database (CVE-2000-0188)

National Cyber-Alert System Vulnerability Summary: CVE-2000-0188
Orirignal release date: 2000-02-27 Source: US-CERT/NIST ### Overview EZShopper 3.0 search.cgi CGI script allows remote attackers to read arbitrary files via a .. (dot dot) attack or execute commands via shell metacharacters. ### Impact CVSS Severity: 7 (High) Range: remote Authentication: input Impact Type: sec_prot other="1" ### Reference to Advisories, Solutions, and Tools External Source: ISS X-Force Name: ezshopper-loadpage-cgi(4044) Hyperlink: http://xforce.iss.net/static/4044.php External Source: Bugtraq Name: EZ Shopper 3.0 shopping cart CGI remote command execution Hyperlink: http://www.securityfocus.com/frames/?content=/templates/archive.pike%3Flist%3D1%26msg%3D200002270932.UAA19852@jawa.chilli.net.au External Source: BUGTRAQ Name: 20000227 EZ Shopper 3.0 shopping cart CGI remote command execution Hyperlink: http://archives.neohapsis.com/archives/bugtraq/2000-02/0356.html External Source: BID Name: 1014 Hyperlink: http://www.securityfocus.com/bid/1014 ### Vulnerable Software and Vendor EZShopper (Alex Heiphetz Group) Technical Details CVE Standard Vulnerability Entry: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0188