PT-2000-1911 · Element · Element Instantshop

Published 2000-12-11 · Updated 2017-10-10 · CVE-2000-1001

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Element InstantShop (affected versions not specified)

Description The issue allows remote attackers to modify price information. This is achieved by exploiting the add 2 basket.asp file in Element InstantShop via the price hidden form variable.

Recommendations For Element InstantShop, restrict access to the add 2 basket.asp file to minimize the risk of exploitation. Avoid using the price variable in the affected file until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2000-1001

Affected Products

Element Instantshop

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2000-1001 · Security Note
• http://marc.info/?l=bugtraq&m=97240616129614&w=2 · Note
• http://osvdb.org/6487 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/5402 · Note