Cactushop (V6) allows remote users to download the database which contains creditcard
numbers and critical information. The affected carts default installation gives away the path to database file. As a result, an attacker exploiting this vulnerability will be able to obtain detailed private customer information, including credit card numbers, order details, addresses, telephone numbers, etc.
Hackers Center Security Group (http://www.hackerscenter.com)
Class: Improper Instalation configuration.
CACTUSHOP v.6 ASP SHOPPING CART
Path Disclosure Exploits:
* Privous version v.5 is effected and older might also be effected.
* Attackers can exploit these issues via a web client.
Proff of Concept: http://i12.tinypic.com/5x8nxp5.jpg