CVE-2002-1798 File upload in n/a
Remote attackers can upload arbitrary PHP files for code execution or access sensitive credit card information via direct requests to admin scripts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2002-1798?
CVE-2002-1798 is a critical vulnerability in n/a, published on 28 Jun 2005. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
MidiCart PHP, PHP Plus, and PHP Maxi allows remote attackers to (1) upload arbitrary php files via a direct request to admin/upload.php or (2) access sensitive information via a direct request to admin/credit_card_info.php.
Weakness: CWE-425
Which versions are affected by CVE-2002-1798?
It affects 3 products.
Products include Midicart Midicart Php, Midicart Midicart Php Maxi, Midicart Midicart Php Plus.
How do I fix CVE-2002-1798?
No fix has been published for CVE-2002-1798 yet. Limit exposure of the affected software until one is available.
Is CVE-2002-1798 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2002-1798 exists.
Public exploit code: 2 Exploit-DB entries.
Sources
Also known as CVE-2002-2160, GHSA-xj93-8hff-x47c.