Vulnerabilities

TI-2008-02756 CVE-2008-2882 · GHSA-3w4g-jj6x-f73c

upgrade.asp in sHibby sHop 2.2 and earlier does not require administrative…

LOW 38

upgrade.asp in sHibby sHop 2.2 and earlier does not require administrative authentication, which allows remote attackers to update a file or have unspecified other impact via a direct request.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.0258 Published 2008-06-26 No fix listed CWE-264

TI-2008-02747 CVE-2008-2873 · GHSA-2cj5-9fm4-hqv6

sHibby sHop 2.2 and earlier stores sensitive information under the web root with…

LOW 28

sHibby sHop 2.2 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request to Db/urun.mdb.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.02587 Published 2008-06-26 No fix listed CWE-264

TI-2008-02746 CVE-2008-2872 · GHSA-7g3f-h9r7-66xv

SQL injection vulnerability in default.asp in sHibby sHop 2.2 and earlier allows remote…

LOW 35

SQL injection vulnerability in default.asp in sHibby sHop 2.2 and earlier allows remote attackers to execute arbitrary SQL commands via the sayfa parameter.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.00973 Published 2008-06-26 No fix listed CWE-89

Vulnerabilities

Filters

upgrade.asp in sHibby sHop 2.2 and earlier does not require administrative…

sHibby sHop 2.2 and earlier stores sensitive information under the web root with…

SQL injection vulnerability in default.asp in sHibby sHop 2.2 and earlier allows remote…