exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

KonaKart eCommerce Platform Directory Traversal

KonaKart eCommerce Platform Directory Traversal
Posted Feb 1, 2018
Authored by ajcraggs

KonaKart eCommerce Platform versions prior to 8.8 suffer from a directory traversal vulnerability.

tags | advisory, file inclusion
advisories | CVE-2017-17108
SHA-256 | 69b02968b66401d2c8733fae55bc3d34bcb6af705d806f25e6c8dcee66aa308b

KonaKart eCommerce Platform Directory Traversal

Change Mirror Download
Product overview:

"KonaKart is a java based eCommerce software platform trusted by top brands throughout the world to give them a stable, high-
performance online store".

Vulnerability overview:

KonaKart eCommerce Platform prior to verion 8.8 is vulnerable to a directory traversal flaw in the admin console that would allow an attacker to download sensitive application or system files, or upload malicious files and take control of the server. The vulnerability exists due to improper validation of the upload file path.

The vendor has released version 8.8 which among other things, addresses this issue. It includes new functionality which allows administrators to pre-define allowed file paths and does not allow writing to or downloading from locations outside of these pre-defined file paths.

The vulnerability has been assigned CVE-2017-17108.

To mitigate the issue, users should:

- Apply the latest patch (ie. update to v8.8)
- Ensure default KonaKart default accounts are removed or have strong passwords set
- Restrict access to the shop administrative console via IP white listing

Timeline:

24/11/2017 - Vulnerability discovered
28/11/2017 - Vulnerability disclosed to vendor and discussion around impact and exploitability ensues.
04/12/2017 - CVE requested and assigned; vendor advised of CVE number. Work commences by vendor to fix issue and confirm patch resolves said vulnerability.
20/01/2018 - Patch released by vendor and users advised to patch.
Login or Register to add favorites

File Archive:

April 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Apr 1st
    10 Files
  • 2
    Apr 2nd
    26 Files
  • 3
    Apr 3rd
    40 Files
  • 4
    Apr 4th
    6 Files
  • 5
    Apr 5th
    26 Files
  • 6
    Apr 6th
    0 Files
  • 7
    Apr 7th
    0 Files
  • 8
    Apr 8th
    22 Files
  • 9
    Apr 9th
    14 Files
  • 10
    Apr 10th
    10 Files
  • 11
    Apr 11th
    13 Files
  • 12
    Apr 12th
    14 Files
  • 13
    Apr 13th
    0 Files
  • 14
    Apr 14th
    0 Files
  • 15
    Apr 15th
    30 Files
  • 16
    Apr 16th
    10 Files
  • 17
    Apr 17th
    0 Files
  • 18
    Apr 18th
    0 Files
  • 19
    Apr 19th
    0 Files
  • 20
    Apr 20th
    0 Files
  • 21
    Apr 21st
    0 Files
  • 22
    Apr 22nd
    0 Files
  • 23
    Apr 23rd
    0 Files
  • 24
    Apr 24th
    0 Files
  • 25
    Apr 25th
    0 Files
  • 26
    Apr 26th
    0 Files
  • 27
    Apr 27th
    0 Files
  • 28
    Apr 28th
    0 Files
  • 29
    Apr 29th
    0 Files
  • 30
    Apr 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close