bugtraq - Improper authentication checking in Alan Ward Acart

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: 4 Dec 2003 06:12:42 -0000
From: <parag0d@...eaker.net>
To: bugtraq@...urityfocus.com
Subject: Improper authentication checking in Alan Ward Acart

Vulnerability:	Improper authentication checking for delete

Discussion:	Due to improper authentication checking a pop-up opened by any of the multiple XSS vulnerabilities by the admin of the site can cause a database compromise.

Exploit:	By using one of the multiple XSS vulnerabilities in this script, an attacker can cause the site administrator to open a new window and delete products or entire categories of products from the database.  The syntax is below:

www.example.com/acart2_0//admin/category.asp?catcode=1&stage=delete

Solution:	The developer needs to implement a new authentication mechanism for deletion of data.

Credit:	CyberArmy Application and Code Auditing Team
	Parag0d

The developer was contacted regarding this matter, but never gave a reply.