Vulnerability Details : CVE-2004-2221

Buffer overflow in SoftCart.exe in Mercantec SoftCart 4.00b allows remote attackers to execute arbitrary code via a long parameter in an HTTP GET request.

Vulnerability category: OverflowExecute code

Published 2004-12-31 05:00:00

Updated 2017-07-11 01:31:43

Source MITRE

View at NVD, CVE.org

At least one public exploit which can be used to exploit this vulnerability exists!

Exploit prediction scoring system (EPSS) score for CVE-2004-2221

Probability of exploitation activity in the next 30 days: 60.63%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 97 % EPSS Score History EPSS FAQ

Metasploit modules for CVE-2004-2221

Mercantec SoftCart CGI Overflow

Disclosure Date : 2004-08-19

exploit/bsdi/softcart/mercantec_softcart

This is an exploit for an undisclosed buffer overflow in the SoftCart.exe CGI as shipped with Mercantec's shopping cart software. It is possible to execute arbitrary code by passing a malformed CGI parameter in an HTTP GET request. This issue is known to affect SoftCart version 4.00b. Authors: - skape <[email protected]> - trew

More information

CVSS scores for CVE-2004-2221

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Source
7.5	HIGH	AV:N/AC:L/Au:N/C:P/I:P/A:P	10.0	6.4	[email protected]
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial

References for CVE-2004-2221

Products affected by CVE-2004-2221