OXID eShop Administration Interface Security Bypass Vulnerability
BID:42656
Info
OXID eShop Administration Interface Security Bypass Vulnerability
| Bugtraq ID: | 42656 |
| Class: | Design Error |
| CVE: |
CVE-2009-3112 |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 18 2009 12:00AM |
| Updated: | Feb 18 2009 12:00AM |
| Credit: | OXID eSales AG |
| Vulnerable: |
OXID eSales AG OXID eShop Professional 4.0 0_13895 OXID eSales AG OXID eShop Professional 4.0.1.0_15990 OXID eSales AG OXID eShop Professional 4.0.0.2_14842 OXID eSales AG OXID eShop Professional 4.0.0.1_14455 OXID eSales AG OXID eShop Professional 4.0.0.0_14260 OXID eSales AG OXID eShop Professional 4.0.0 0_13934 OXID eSales AG OXID eShop Enterprise 4.0.1.0_15990 OXID eSales AG OXID eShop Enterprise 4.0.0.2_14967 OXID eSales AG OXID eShop Enterprise 4.0.0.2_14842 OXID eSales AG OXID eShop Enterprise 4.0.0.1_14455 OXID eSales AG OXID eShop Enterprise 4.0.0.0_14260 OXID eSales AG OXID eShop Enterprise 4.0.0 0_13934 OXID eSales AG OXID eShop Enterprise 4.0.0 0_13895 OXID eSales AG OXID eShop Community 4.0.1.0_15990 OXID eSales AG OXID eShop Community 4.0.0.2_14967 OXID eSales AG OXID eShop Community 4.0.0.2_14842 OXID eSales AG OXID eShop Community 4.0.0.1_14455 OXID eSales AG OXID eShop Community 4.0.0.0_14260 OXID eSales AG OXID eShop Community 4.0.0 0_13934 OXID eSales AG OXID eShop Community 4.0.0 0_13895 |
| Not Vulnerable: |
OXID eSales AG OXID eShop Professional 4.1 OXID eSales AG OXID eShop Enterprise 4.1.0 OXID eSales AG OXID eShop Community 4.1 |
Discussion
OXID eShop Administration Interface Security Bypass Vulnerability
OXID eShop is prone to a security-bypass vulnerability.
Remote attackers can exploit this issue to bypass security restrictions and gain unauthorized administrative access to the shop backend.
Versions prior to OXID eShop Professional, Community, and Enterprise 4.1.0 are vulnerable.
OXID eShop is prone to a security-bypass vulnerability.
Remote attackers can exploit this issue to bypass security restrictions and gain unauthorized administrative access to the shop backend.
Versions prior to OXID eShop Professional, Community, and Enterprise 4.1.0 are vulnerable.
Exploit / POC
OXID eShop Administration Interface Security Bypass Vulnerability
An attacker can exploit this issue by using readily available network utilities.
An attacker can exploit this issue by using readily available network utilities.
Solution / Fix
OXID eShop Administration Interface Security Bypass Vulnerability
Solution:
Updates are available. Please see the references for details.
Solution:
Updates are available. Please see the references for details.
References
OXID eShop Administration Interface Security Bypass Vulnerability
References:
References:
- OXID eSales AG Security Bulletin 2009-001 (OXID eSales AG)
- OXID eShop Homepage (OXID eSales AG)