CVE-2005-1032

Rejected reason: cart.php in LiteCommerce might allow remote attackers to obtain sensitive information via invalid (1) category_id or (2) product_id parameters. NOTE: this issue was originally claimed to be due to SQL injection, but the original researcher is known to be frequently inaccurate with respect to bug type and severity. The vendor has disputed this issue, saying "These reports are credited to malicious person we refused to hire. We have not taken legal action against him only because he is located in India. The vulnerabilites reported can not be reproduced, hence information you provide is contrary to fact." Further investigation by CVE personnel shows that an invalid SQL syntax error could be generated, but it only reveals portions of underlying database structure, which is already available in documentation from the vendor, and it does not appear to lead to path disclosure. Therefore, this issue is not a vulnerability or an exposure, and it probably should be REJECTED

Published

Apr 6, 2005

Last Modified

Nov 7, 2023

Status

Rejected

• CVE-2005-1026Multiple SQL injection vulnerabilities in SnailSource phpBB …
• CVE-2005-1027Multiple cross-site scripting (XSS) vulnerabilities in PHP-N…
• CVE-2005-1028PHP-Nuke 6.x through 7.6 allows remote attackers to obtain s…
• CVE-2005-1029Multiple SQL injection vulnerabilities in Active Auction Hou…
• CVE-2005-1030Multiple cross-site scripting (XSS) vulnerabilities in Activ…
• CVE-2005-1031RUNCMS 1.1A, and possibly other products based on e-Xoops (e…
• CVE-2005-1033CubeCart 2.0.6 allows remote attackers to obtain sensitive i…
• CVE-2005-1034SurgeFTP 2.2m1 allows remote attackers to cause a denial of …
• CVE-2005-1035Multiple buffer overflows in Pavuk before 0.9.32 have unknow…
• CVE-2005-1036FreeBSD 5.x to 5.4 on AMD64 does not properly initialize the…7.8
• CVE-2005-1037Unknown vulnerability in AIX 5.3.0, when configured as an NI…
• CVE-2005-1038crontab in Vixie cron 4.1, when running with the -e option, …