EC-CUBE 'LC_Page_Admin_Customer_SearchCustomer.php' Security Bypass Vulnerability

Bugtraq ID:	37223
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 07 2009 12:00AM
Updated:	Dec 08 2009 10:54PM
Credit:	Reported by the vendor
Vulnerable:	EC-CUBE EC-CUBE 2.4.1 EC-CUBE EC-CUBE 2.3 EC-CUBE EC-CUBE 1.4.7 EC-CUBE EC-CUBE 1.4.6 EC-CUBE EC-CUBE 1.0 EC-CUBE EC-CUBE 2.3.0-rc1 EC-CUBE EC-CUBE 2.2.0-beta EC-CUBE EC-CUBE 2.1.2a EC-CUBE EC-CUBE 2.1.1-beta EC-CUBE EC-CUBE 1.5.0-beta2 EC-CUBE EC-CUBE 1.5.0-beta EC-CUBE EC-CUBE 1.0.1a beta
Not Vulnerable:	EC-CUBE EC-CUBE 2.4.2

EC-CUBE 'LC_Page_Admin_Customer_SearchCustomer.php' Security Bypass Vulnerability

EC-CUBE is prone to a security-bypass vulnerability.

An attacker can exploit this vulnerability to bypass certain security restrictions and gain access to restricted customer information.

Versions prior to EC-CUBE 2.4.2 are vulnerable.

EC-CUBE 'LC_Page_Admin_Customer_SearchCustomer.php' Security Bypass Vulnerability

Attackers can exploit this issue via a browser.

EC-CUBE 'LC_Page_Admin_Customer_SearchCustomer.php' Security Bypass Vulnerability

Solution:
The vendor has released updates. Please see the references for details.

EC-CUBE 'LC_Page_Admin_Customer_SearchCustomer.php' Security Bypass Vulnerability

References:

• EC-Cube 2.4.2 Changelog (EC-Cube)
  
• EC-CUBE information disclosure vulnerability (EC-CUBE)
  
• EC-CUBE security advisories (EC-CUBE)