CVE-2013-4702
Quick assessment
Affected
n/a n/a
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
LOCKON EC-CUBE是日本LOCKON公司开发的一套开源的电子商务网站构建平台。该平台支持商品登录、用户评价、美工布局等。 Windows平台上的LOCKON EC-CUBE 2.12.0至2.12.5版本中的data/class/api/SC_Api_Operation.php文件中的‘doApiAction’函数中存在多个目录遍历漏洞。远程攻击者可通过(1)Operation(2)Service(3)Style(4)Validate或(5)Version值利用这些漏洞读取任意文件。
Possible ATT&CK Techniques 2 AI
T1140 · Deobfuscate/Decode Files or Information T1136 · Create Account
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2013-4702
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
Multiple directory traversal vulnerabilities in the doApiAction function in data/class/api/SC_Api_Operation.php in LOCKON EC-CUBE 2.12.0 through 2.12.5 on Windows allow remote attackers to read arbitrary files via vectors involving a (1) Operation, (2) Service, (3) Style, (4) Validate, or (5) Version value.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
LOCKON EC-CUBE 多个目录遍历漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
LOCKON EC-CUBE是日本LOCKON公司开发的一套开源的电子商务网站构建平台。该平台支持商品登录、用户评价、美工布局等。 Windows平台上的LOCKON EC-CUBE 2.12.0至2.12.5版本中的data/class/api/SC_Api_Operation.php文件中的‘doApiAction’函数中存在多个目录遍历漏洞。远程攻击者可通过(1)Operation(2)Service(3)Style(4)Validate或(5)Version值利用这些漏洞读取任意文件。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | n/a | n/a | - |
|
II. Public POCs for CVE-2013-4702
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2013-4702
请登录查看更多情报信息。
Vendor Advisories for CVE-2013-4702 (3)
Other References for CVE-2013-4702 (3)
-
🔗 http://svn.ec-cube.net/open_trac/changeset/22891 x_refsource_CONFIRM
-
🔗 http://www.ec-cube.net/info/weakness/20130829/index.php x_refsource_CONFIRM
-
🔗 http://www.ec-cube.net/info/weakness/weakness.php?id=50 x_refsource_CONFIRM
Same Patch Batch · n/a · 2013-08-30 · 9 CVEs total
| CVE-2013-3485 | LULU Soda PDF 多个不安全库加载任意代码执行漏洞 | |
| CVE-2013-3346 | Adobe Reader和Acrobat 内存损坏漏洞 | |
| CVE-2013-3474 | Cisco Wireless LAN Controller Web管理界面拒绝服务漏洞 | |
| CVE-2013-5469 | Cisco IOS TCP实现拒绝服务漏洞 | |
| CVE-2012-5744 | Cisco Identity Services Engine 多个跨站脚本漏洞 | |
| CVE-2013-3463 | Cisco Adaptive Security Appliance 拒绝服务漏洞 | |
| CVE-2013-3467 | Cisco Unified Computing System 内存泄露多个本地拒绝服务漏洞 | |
| CVE-2013-3470 | Cisco IOS XR Software 拒绝服务漏洞 |
IV. Related Vulnerabilities
V. Comments for CVE-2013-4702
No comments yet