Unscored severity · published Feb 3, 2009
CVE-2009-0412
The ProcessLogin function in class.auth.php in Interspire Shopping Cart (ISC) 4.0.1 Ultimate edition allows remote attackers to bypass authentication and obtain administrative…
–
CVSS
1.5%
EPSS
No
On KEV
Description
The ProcessLogin function in class.auth.php in Interspire Shopping Cart (ISC) 4.0.1 Ultimate edition allows remote attackers to bypass authentication and obtain administrative access by reusing the RememberToken cookie after a failed admin login attempt.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 75% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SC
Shopping Cart · Interspire
4.0.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-0412
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-0412
www.securityfocus.com
http://www.securityfocus.com/archive/1/499967/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/bid/33212
www.securitytracker.com
http://www.securitytracker.com/id?1021557
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/47899
More from Shopping Cart
–
CVE-2008-1076
Cross-site scripting (XSS) vulnerability in search.php in Interspire Shopping Cart 1.x allows remote attackers to inject arbitrary web script or HTML via the search_query…