• info
• discussion
• exploit
• solution
• references

McMurtrey/Whitaker & Associates Cart32 Remote Administration Password Vulnerability

Solution:
McMurtrey/Whitaker & Associates has released upgrades which addresses this issue.

Official Patches:


McMurtrey/Whitaker & Associates Cart32 2.6

• McMurtrey/Whitaker & Associates c32admin (2.6)
  Copy into the Cart32 directory. "On ISP" installations do not need this file.
  http://www.cart32.com/download/v26latestbuilds/c32admin.exe


• McMurtrey/Whitaker & Associates c32web (2.6)
  Copy into the CGI directory.
  ftp://ftp.cart32.com/v26latestbuilds/c32web.exe


• McMurtrey/Whitaker & Associates cart
  Copy into the Cart32 directory.
  http://www.cart32.com/download/v26latestbuilds/cart.exe


• McMurtrey/Whitaker & Associates cart32 (2.6)
  Copy into the CGI directory.
  ftp://ftp.cart32.com/v26latestbuilds/cart32.exe

McMurtrey/Whitaker & Associates Cart32 3.0

• McMurtrey/Whitaker & Associates c32admin (3.0)
  Download this file only if you are running the "On your own server" version. Place this file in the installation directory which is c:\program files\mwainc\cart32 by default.
  ftp://ftp.cart32.com/v30latestbuilds/c32admin.exe


• McMurtrey/Whitaker & Associates c32web (3.0)
  Copy into the CGI directory.
  ftp://ftp.cart32.com/v30latestbuilds/c32web.exe


• McMurtrey/Whitaker & Associates cart32 (3.0)
  Copy into the CGI directory.
  http://www.cart32.com/download/v30latestbuilds/cart32.exe