PT-2010-1375 · Agoracart · Agoracart+1

Published 2010-01-04 · Updated 2017-08-17 · CVE-2009-4555

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions AgoraCart versions 5.2.005 through 5.2.006 AgoraCart GOLD version 5.5.005

Description The issue allows remote attackers to hijack the authentication of administrators for requests that modify a .htaccess file via an unspecified request to "protected/manager.cgi" or change the password of an administrative account. This is due to multiple cross-site request forgery (CSRF) vulnerabilities.

Recommendations For AgoraCart versions 5.2.005 through 5.2.006, consider restricting access to the "protected/manager.cgi" endpoint until a fix is available. For AgoraCart GOLD version 5.5.005, avoid using the administrative account password change feature until the issue is resolved. As a temporary workaround, consider implementing additional authentication measures to prevent unauthorized requests to sensitive endpoints.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2009-4555

Affected Products

Agoracart

Agoracart Gold

References · 4

• http://secunia.com/advisories/36789 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-4555 · Security Note
• http://holisticinfosec.org/content/view/129/45 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/53808 · Note