CVE-2009-3904

ALTO 7.5CVE-2009-3904 · Published 06/11/2009 · updated 16/06/2026

En resumen

CVE-2009-3904 es una vulnerabilidad ALTO (CVSS 7.5) que afecta a cubecart (cubecart).
Probabilidad de explotación en los próximos 30 días (EPSS): 8.7%, mayor que el 95.1% de las vulnerabilidades.
Aún no hay una versión corregida: sigue el aviso del fabricante en Referencias.

Package	Affected versions	Patched versions
cubecart cubecart	`= 4.3.4`	No fix yet

Description

classes/session/cc_admin_session.php in CubeCart 4.3.4 does not properly restrict administrative access permissions, which allows remote attackers to bypass restrictions and gain administrative access via a HTTP request that contains an empty (1) sessID (ccAdmin cookie), (2) X_CLUSTER_CLIENT_IP header, or (3) User-Agent header.

References

forums.cubecart.com/index.php
forums.cubecart.com/index.php · Patch
secunia.com/advisories/37197 · Vendor Advisory
acunetix.com/blog/websecuritynews/cubecart-4-session-management-bypass-leads-to-administrator-access · Exploit
securityfocus.com/archive/1/507594/100/0/threaded
securityfocus.com/bid/36882 · Exploit
securitytracker.com/id · Exploit
vupen.com/english/advisories/2009/3113 · Patch
exchange.xforce.ibmcloud.com/vulnerabilities/54062

Más vulnerabilidades de cubecart

Ver todo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

cubecart

= 4.3.4

No fix yet

Description

Más vulnerabilidades de cubecart

Ver todo →