CVE-2017-14653

ASP4CMS AspCMS 2.7.2 contains an information-disclosure flaw in member/Orderinfo.asp. A modified OrderNo parameter allows remote authenticated users to read arbitrary order information, exposing partial confidentiality. The CVE entry documents this as a read-access vulnerability with MEDIUM impac...

CVE-2017-14653: Exposure of Sensitive Information to an Unauthorized Actor

member/Orderinfo.asp in ASP4CMS AspCMS 2.7.2 allows remote authenticated users to read arbitrary order information via a modified OrderNo parameter...

PT-2017-13614

Name of the Vulnerable Software and Affected Versions AspCMS version 2.7.2 Description The issue allows remote authenticated users to read arbitrary order information. This is achieved by modifying the OrderNo parameter in the 'member/Orderinfo.asp' page. Recommendations For AspCMS version 2.7.2,...