PT-2014-6232 · Shopizer · Shopizer

Publicado 2014-07-15 · Atualizado 2018-10-09 · CVE-2014-4962

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Shopizer versions 1.1.5 and earlier

Description The issue allows remote attackers to manipulate the total cost of their shopping cart by entering a negative number in the productQuantity parameter. This causes the price of the item to be subtracted from the total cost, potentially allowing attackers to reduce their total cost.

Recommendations For Shopizer versions 1.1.5 and earlier, as a temporary workaround, consider restricting the use of the productQuantity parameter to positive numbers only until a fix is available.

Exploit

Correção

Enumeração de Fraquezas

CWE-189

Identificadores relacionados

CVE-2014-4962

Produtos afetados

Shopizer

Referências · 4

• 🔥 https://exploit-db.com/exploits/34062 · Exploit
• 🔥 http://seclists.org/fulldisclosure/2014/Jul/38 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-4962 · Nota de Segurança
• http://securityfocus.com/archive/1/532726/100/0/threaded · Nota