osCommerce 2.2 - Authentication Bypass

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1053829 漏洞类型
发布时间 2003-04-15 更新时间 2003-04-15
CVE编号 N/A CNNVD-ID N/A
漏洞平台 PHP CVSS评分 N/A
|漏洞来源
https://www.exploit-db.com/exploits/22498
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
source: http://www.securityfocus.com/bid/7357/info

osCommerce has been reported prone to authentication bypass vulnerability.

It has been reported that osCommerce uses HTTP header information as a part of its authentication mechanism. Reportedly an attacker may spoof parts of the HTTP header and, in doing so, subvert osCommerce authentication systems set in place.

This attack may be used in conjunction with other attacks to disclose, what may be sensitive information, to the attacker.

It should be noted that although osCommerce version 2.2cvs was reported vulnerable, previous versions may also be affected. 

http://www.example.com/oscommerce_installation/default.php/cPath/../../../../../