JustAddCommerce Hidden Form Field Manipulation Vulnerability

Bugtraq ID:	6179
Class:	Configuration Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 13 2002 12:00AM
Updated:	Nov 13 2002 12:00AM
Credit:	Discovery is credited to <[email protected]>.
Vulnerable:	Rich Media Technologies JustAddCommerce Standard 5.0
Not Vulnerable:

JustAddCommerce Hidden Form Field Manipulation Vulnerability

JustAddCommerce does not properly validate data contained in hidden form fields in the default configuration. As a result, an attacker can modify the data contained in the hidden fields and submit them to the server. This may be used to manipulate prices for items purchased through a website using the JustAddCommerce shopping system. It may also be possible to manipulate other data contained in hidden form fields.

This issue may be present when JustAddCommerce is deployed with the "Standard Security" setting, which is the default security level. JustAddCommerce provides other security settings which will eliminate this problem.

JustAddCommerce Hidden Form Field Manipulation Vulnerability

There is no exploit code required.

JustAddCommerce Hidden Form Field Manipulation Vulnerability

References:

• JustAddCommerce Product Homepage (Rich Media Technologies)
  
• Well known flaw in web cart software remains wide open ()