Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2001-1014: WebDiscount eShop lets attackers run commands via URL

CVE-2001-1014 · published 25 years ago

Summary

The online shop system from WebDiscount eShop can be tricked into executing system commands when a specially crafted value is placed in the "seite" field of a web request. An attacker could therefore run any code on the server, potentially taking control of the site or accessing its data. Update to the latest version or apply the vendor’s patch and ensure input is properly filtered to block shell characters.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
michael_boehme	webdiscount_e_shop_online_shop_system	1.0 `cpe:2.3:a:michael_boehme:webdiscount_e_shop_online_shop_system:1.0:::::::*`

Original advisory text

eshop.pl in WebDiscount(e)shop allows remote attackers to execute arbitrary commands via shell metacharacters in the seite parameter.

References

http://www.securityfocus.com/archive/1/214456 Exploit Vendor Advisory
http://www.securityfocus.com/bid/3340 Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/7128

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

7.5 High

Exploitation

2% chance of attack within 30 days

Timeline

Published15 Sep 2001

Updated29 Oct 2026

First seen29 Sep 2026

Sources

CVE-2001-1014 · NVD

Track software like this

Free during beta