PT-2015-7409 · Cubecart · Cubecart

Fernando Camara · Publicado 2015-09-28 · Atualizado 2016-12-07 · CVE-2015-6928

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions CubeCart versions 5.2.12 through 5.2.16 CubeCart versions 6.x before 6.0.7

Description The issue arises from improper validation of password reset requests, allowing remote attackers to change the administrator password. This can be achieved by sending a recovery request with a space character in the validate parameter and the administrator email in the email parameter.

Recommendations For CubeCart versions 5.2.12 through 5.2.16, update to version 5.2.17 or later to resolve the issue. For CubeCart versions 6.x before 6.0.7, update to version 6.0.7 or later to resolve the issue.

Exploit

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

CVE-2015-6928

Produtos afetados

Cubecart

Referências · 6

• 🔥 http://seclists.org/fulldisclosure/2015/Sep/40 · Exploit
• 🔥 http://packetstormsecurity.com/files/133535/CubeCart-6.0.6-Administrative-Bypass.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-6928 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6928 · Nota
• http://securitytracker.com/id/1034015 · Nota
• https://forums.cubecart.com/topic/50277-critical-security-issue-admin-account-hijack · Aviso do Fabricante