CVE-2009-3904

classes/session/ccadminsession.php in CubeCart 4.3.4 does not properly restrict administrative access permissions, which allows remote attackers to bypass restrictions and gain administrative access via a HTTP request that contains an empty 1 sessID ccAdmin cookie, 2 XCLUSTERCLIENTIP header, or 3...