CVE-2000-0254 Information disclosure in n/a

Medium 5.0 Published 22 Jan 2001 Updated 8 Aug 2024

Remote attackers can access shopping cart database and configuration data by manipulating specific URL parameters in the dansie shopping cart application.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2000-0254?

CVE-2000-0254 is a medium-severity vulnerability in n/a, published on 22 Jan 2001. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The dansie shopping cart application cart.pl allows remote attackers to obtain the shopping cart database and configuration information via a URL that references either the env, db, or vars form variables.

Which versions are affected by CVE-2000-0254?

It affects 1 product.

Products include Craig Dansie Dansie Shopping Cart.

How do I fix CVE-2000-0254?

No fix has been published for CVE-2000-0254 yet. Limit exposure of the affected software until one is available.

Is CVE-2000-0254 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2000-0254 exists.

Public exploit code: 1 Exploit-DB entry.

Sources

Also known as GHSA-v93j-3f23-p5mq.