Admin Access With Levels Plug-in For osCommerce Access Control Bypass Vulnerability

Bugtraq ID:	10235
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 29 2004 12:00AM
Updated:	Apr 29 2004 12:00AM
Credit:	Discovery of this vulnerability has been credited to Ilya Sher.
Vulnerable:	Admin Access With Levels Admin Access With Levels Plug-in 1.5.1
Not Vulnerable:

Admin Access With Levels Plug-in For osCommerce Access Control Bypass Vulnerability

Admin Access With Levels Plug-in for osCommerce is reported prone to an access control bypass vulnerability. The issue is reported to present itself when a user invokes a request for a script contained in the "admin" folder, passing a specific URI parameter in the request.

An attacker may exploit this condition to ultimately gain administrative access to the affected site.

Admin Access With Levels Plug-in For osCommerce Access Control Bypass Vulnerability

There is no exploit required.

Admin Access With Levels Plug-in For osCommerce Access Control Bypass Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Admin Access With Levels Plug-in For osCommerce Access Control Bypass Vulnerability

References:

• Admin Access With Levels for osCommerce Homepage (Admin Access With Levels )