Shopizer Multiple Security Vulnerabilities
BID:68490
Info
Shopizer Multiple Security Vulnerabilities
| Bugtraq ID: | 68490 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 10 2014 12:00AM |
| Updated: | Jul 10 2014 12:00AM |
| Credit: | K. Gudinavicius of SEC Consult Vulnerability Lab |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
Shopizer Multiple Security Vulnerabilities
Shopizer is prone to an authentication-bypass vulnerability, an authorization-bypass vulnerability and a hard-coded encryption key vulnerability.
Successful exploits will allow attackers to obtain sensitive information, bypass the authentication mechanism and perform unauthorized actions. This may aid in further attacks.
Shopizer 1.1.5 and prior are vulnerable.
Shopizer is prone to an authentication-bypass vulnerability, an authorization-bypass vulnerability and a hard-coded encryption key vulnerability.
Successful exploits will allow attackers to obtain sensitive information, bypass the authentication mechanism and perform unauthorized actions. This may aid in further attacks.
Shopizer 1.1.5 and prior are vulnerable.
Exploit / POC
Shopizer Multiple Security Vulnerabilities
Attackers can use standard, readily available tools to exploit these issues.
The researcher who discovered this issue has created a proof-of-concept. Please see the references for more information.
Attackers can use standard, readily available tools to exploit these issues.
The researcher who discovered this issue has created a proof-of-concept. Please see the references for more information.
Solution / Fix
Shopizer Multiple Security Vulnerabilities
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Shopizer Multiple Security Vulnerabilities
References:
References: