OXID eShop Write Access Security Bypass Vulnerability
BID:42660
Info
OXID eShop Write Access Security Bypass Vulnerability
| Bugtraq ID: | 42660 |
| Class: | Design Error |
| CVE: |
CVE-2009-3113 |
| Remote: | Yes |
| Local: | No |
| Published: | May 11 2009 12:00AM |
| Updated: | May 11 2009 12:00AM |
| Credit: | Andreas Ziethen |
| Vulnerable: |
OXID eSales AG OXID eShop Professional 4.0 0_13895 OXID eSales AG OXID eShop Professional 4.1.1-18442 OXID eSales AG OXID eShop Professional 4.1.0 17976 OXID eSales AG OXID eShop Professional 4.0.1.0_15990 OXID eSales AG OXID eShop Professional 4.0.0.2_14842 OXID eSales AG OXID eShop Professional 4.0.0.1_14455 OXID eSales AG OXID eShop Professional 4.0.0.0_14260 OXID eSales AG OXID eShop Professional 4.0.0 0_13934 OXID eSales AG OXID eShop Enterprise 4.1.1-18442 OXID eSales AG OXID eShop Enterprise 4.1.0 17976 OXID eSales AG OXID eShop Enterprise 4.0.1.0_15990 OXID eSales AG OXID eShop Enterprise 4.0.0.2_14967 OXID eSales AG OXID eShop Enterprise 4.0.0.2_14842 OXID eSales AG OXID eShop Enterprise 4.0.0.1_14455 OXID eSales AG OXID eShop Enterprise 4.0.0.0_14260 OXID eSales AG OXID eShop Enterprise 4.0.0 0_13934 OXID eSales AG OXID eShop Enterprise 4.0.0 0_13895 OXID eSales AG OXID eShop Community 4.1.1-18442 OXID eSales AG OXID eShop Community 4.1.0 17976 OXID eSales AG OXID eShop Community 4.0.1.0_15990 OXID eSales AG OXID eShop Community 4.0.0.2_14967 OXID eSales AG OXID eShop Community 4.0.0.2_14842 OXID eSales AG OXID eShop Community 4.0.0.1_14455 OXID eSales AG OXID eShop Community 4.0.0.0_14260 OXID eSales AG OXID eShop Community 4.0.0 0_13934 OXID eSales AG OXID eShop Community 4.0.0 0_13895 |
| Not Vulnerable: |
OXID eSales AG OXID eShop Professional 4.1.2 OXID eSales AG OXID eShop Enterprise 4.1.2 OXID eSales AG OXID eShop Community 4.1.2 |
Discussion
OXID eShop Write Access Security Bypass Vulnerability
OXID eShop is prone to a security-bypass vulnerability.
Remote attackers can exploit this issue to bypass security restrictions and gain unauthorized write access to product reviews.
Versions prior to OXID eShop Professional, Community, and Enterprise 4.1.2 are vulnerable.
OXID eShop is prone to a security-bypass vulnerability.
Remote attackers can exploit this issue to bypass security restrictions and gain unauthorized write access to product reviews.
Versions prior to OXID eShop Professional, Community, and Enterprise 4.1.2 are vulnerable.
Exploit / POC
OXID eShop Write Access Security Bypass Vulnerability
An attacker can exploit this issue by using readily available network utilities.
An attacker can exploit this issue by using readily available network utilities.
Solution / Fix
OXID eShop Write Access Security Bypass Vulnerability
Solution:
Updates are available. Please see the references for details.
Solution:
Updates are available. Please see the references for details.
References
OXID eShop Write Access Security Bypass Vulnerability
References:
References:
- OXID eSales AG Security Bulletin 2009-002 (OXID eSales AG)
- OXID eShop Homepage (OXID eSales AG)