Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2001-0756: VirtualCatalog allows remote code execution via template

CVE-2001-0756 · published 25 years ago

Summary

The VirtualCatalog component can be tricked into running any code an attacker supplies through the template setting. This could let an attacker take control of the server hosting the catalog. Apply the vendor's update or patch and restrict access to the template feature until it is fixed.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
virtualcart	virtualcatalog	All versions `cpe:2.3:a:virtualcart:virtualcatalog::::::::`

Original advisory text

CatalogMgr.pl in VirtualCatalog (incorrectly claimed to be in VirtualCart) allows remote attackers to execute arbitrary code via the template parameter.

References

http://archives.neohapsis.com/archives/bugtraq/2001-06/0067.html Patch Vendor Advisory
http://marc.info/?l=bugtraq&m=99237435902211&w=2

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

7.5 High

Exploitation

2% chance of attack within 30 days

Timeline

Published18 Oct 2001

Updated29 Oct 2026

First seen29 Sep 2026

Sources

CVE-2001-0756 · NVD

Track software like this

Free during beta