CVE-2008-0736

Published: Feb 13, 2008Modified: Apr 23, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

admin/SA_shipFedExMeter.asp in CandyPress (CP) 4.1.1.26, and possibly other 4.x and 3.x versions, allows remote attackers to obtain the path via a certain value of the FedExAccount parameter.

Affected (2)

Products: Shoppingtree: Candypress Store

Shoppingtree

1 product

Candypress Store

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Shoppingtree Candypress Store	Version 4.1.1.26
Shoppingtree Candypress Store	Version 4.1

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (14)

http://securityreason.com/securityalert/3600

Source: cve@mitre.org

http://www.candypress.com/CPforum/forum_posts.asp?TID=10630&PN=1

Source: cve@mitre.org

Exploit

http://www.securityfocus.com/archive/1/487058/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/27454

Source: cve@mitre.org

Exploit

http://www.vupen.com/english/advisories/2008/0314

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/39941

Source: cve@mitre.org

https://www.exploit-db.com/exploits/4988

Source: cve@mitre.org

http://securityreason.com/securityalert/3600