osCommerce – Authentication Bypass

• Exploit Database
• 121 阅读

• 作者： Nicolas Krassas
  日期： 2011-02-04
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/16113/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19

  This is a bug on old oscommerce / creloaded i just didn't find it in the exploit-db database on the search.   # Exploit Title: OsCommerce/Creloaded tell a friend authentication bypass # Date: 04/02/2010 # Author: Nicolas Krassas # Version: $Id: tell_a_friend.php,v 1.1.1.1 2008/06/29 23:38:03 # Tested on: linux   When /tell_a_friend.php is called directly the user is redirected at /product_info.php?products_id=0 where an access denied message is displayed. Providing a valid product id (eg. /tell_a_friend.php?action=process&products_id=[Product_id] ) though a guest user can bypass the restriction and send unsolicited mails through the system.   Regards, Nicolas Krassas