CVE-2002-1432 describes a critical information disclosure vulnerability in several Coxco Support e-commerce products, including MidiCart ASP and SalesCart. The flaw allows remote attackers to directly access the midicart.mdb database file, which is improperly stored within the web document root, leading to the theft of sensitive customer information. With a CVSS score of 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N) and a FAUCET Risk Score of 94/100, this vulnerability is easily exploitable over the network with low complexity and no authentication required, resulting in a partial compromise of confidentiality. While not listed in CISA's KEV catalog, an exploit is publicly available on ExploitDB, and the vulnerability has garnered significant community discussion, indicating awareness and potential for exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
2.0CPE matchmatch criteria | cpe:2.3:a:coxco_support:a-cart:2.0:*:*:*:*:*:*:* | ||
2.sqlCPE matchmatch criteria | cpe:2.3:a:coxco_support:metacart:2.sql:*:*:*:*:*:*:* | ||
All Versions ImpactedCPE matchmatch criteria | cpe:2.3:a:coxco_support:midicart_asp:*:*:*:*:*:*:*:* | ||
All Versions ImpactedCPE matchmatch criteria | cpe:2.3:a:coxco_support:midicart_asp_maxi:*:*:*:*:*:*:*:* | ||
All Versions ImpactedCPE matchmatch criteria | cpe:2.3:a:coxco_support:midicart_asp_plus:*:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:L/Au:N/C:P/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.