osCommerce Admin Access With Levels plugin in_login Authenticatin Bypass

2004-04-29T07:39:59
ID OSVDB:5717
Type osvdb
Reporter Ilya Sher ()
Modified 2004-04-29T07:39:59

Description

Vulnerability Description

osCommerce contains a flaw in Admin Access With Levels plugin that may allow a malicious user to gain access to administrative functions. The issue is triggered when an attacker accesses scripts in the "admin/" directory by supplying any non-zero value to the "in_login" parameter. This flaw may lead to a loss of Confidentiality.

Solution Description

Upgrade to version 2.2 or higher, as it has been reported to fix this vulnerability. It is also possible to correct the flaw by implementing the following workaround: implement a .htaccess protection scheme for older versions

Short Description

osCommerce contains a flaw in Admin Access With Levels plugin that may allow a malicious user to gain access to administrative functions. The issue is triggered when an attacker accesses scripts in the "admin/" directory by supplying any non-zero value to the "in_login" parameter. This flaw may lead to a loss of Confidentiality.

References:

Vendor URL: http://www.oscommerce.com/ Secunia Advisory ID:11473 ISS X-Force ID: 16009 CVE-2004-2638 Bugtraq ID: 10235