Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.0
CVE-2005-4787: SunShop Shopping Cart lets remote attackers view server details
CVE-2005-4787 · published 20 years ago
Summary
The SunShop Shopping Cart on Turnkey Web Tools can reveal internal server information to anyone who accesses a special page in the shop or admin areas. This exposure could help attackers plan further attacks against the site. Disable or remove the phpinfo pages or restrict access to trusted users to protect the information.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| turnkey_solutions | sunshop_shopping_cart |
3.0 cpe:2.3:a:turnkey_solutions:sunshop_shopping_cart:3.0:*:*:*:*:*:*:* |
Original advisory text
Turnkey Web Tools SunShop Shopping Cart allows remote attackers to obtain sensitive information via a phpinfo action to (1) index.php, (2) admin/index.php, and (3) admin/adminindex.php, which execu...
Turnkey Web Tools SunShop Shopping Cart allows remote attackers to obtain sensitive information via a phpinfo action to (1) index.php, (2) admin/index.php, and (3) admin/adminindex.php, which executes the PHP phpinfo function. NOTE: The vendor has disputed this issue, saying that "Having this in the code makes it easier for us to troubleshoot when issues arise on individual carts. For someone to have a script to do this type of search would require that they know where your shop is actually located. I dont think it really can be construde [sic] as a security issue.
References
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Severity
5.0
Medium
Timeline
Published31 Dec 2005
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2005-4787 · NVD
Track software like this
Free during beta