PT-2009-3067 · Interspire · Interspire Shopping Cart

Publicado 2009-02-03 · Atualizado 2018-10-11 · CVE-2009-0412

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Interspire Shopping Cart (ISC) version 4.0.1 Ultimate edition

Description The issue allows remote attackers to bypass authentication and obtain administrative access. This is achieved by reusing the RememberToken cookie after a failed admin login attempt, exploiting the ProcessLogin function in class.auth.php.

Recommendations For Interspire Shopping Cart (ISC) version 4.0.1 Ultimate edition, consider disabling the ProcessLogin function in class.auth.php as a temporary workaround until a patch is available. Restrict access to administrative login attempts to minimize the risk of exploitation. Avoid reusing the RememberToken cookie after a failed admin login attempt until the issue is resolved.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2009-0412

Produtos afetados

Interspire Shopping Cart

Referências · 6

• http://securityfocus.com/archive/1/499967/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/47899 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0412 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-0412 · Nota de Segurança
• http://securitytracker.com/id?1021557 · Nota
• http://securityfocus.com/bid/33212 · Nota