Cactusoft CactuShop Lite Remote Arbitrary File Deletion Backdoor Vulnerability

It has been reported that Cactusoft CactuShop Lite may be prone to a remote arbitrary file deletion vulnerability that may allow remote attackers to delete arbitrary files on a vulnerable system. The problem is reported to be caused by user-supplied data passed via the 'strEmailAddress' variable of the AddToMailingList() function. This problem is reported to be a backdoor that allows attackers to delete arbitrary files from a vulnerable system leading to a denial of service issue.

It should be noted that Cactusoft CactuShop Lite is demo software and not intended by the vendor for commercial use.

Cactusoft CactuShop Lite version 5.0 has been reported to be prone to this issue.


 

Privacy Statement
Copyright 2010, SecurityFocus