owOfflineCC.asp in OneWorldStore allows remote attackers to obtain sensitive information by modifying the idOrder parameter.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Oneworldstore | Oneworldstore | basic (including) | basic (including) |
| Oneworldstore | Oneworldstore | business (including) | business (including) |
| Oneworldstore | Oneworldstore | enterprise (including) | enterprise (including) |
| Oneworldstore | Oneworldstore | free (including) | free (including) |
| Oneworldstore | Oneworldstore | soho (including) | soho (including) |
References
- http://lostmon.blogspot.com/2005/04/oneworldstore-user-information.html
- http://secunia.com/advisories/15104
- http://securitytracker.com/id?1013796
- http://www.oneworldstore.com/support_security_issue_updates.asp#April_24_2005_Lostmon
- http://www.osvdb.org/15781
- http://www.securityfocus.com/bid/13361
- http://lostmon.blogspot.com/2005/04/oneworldstore-user-information.html
- http://secunia.com/advisories/15104
- http://securitytracker.com/id?1013796
- http://www.oneworldstore.com/support_security_issue_updates.asp#April_24_2005_Lostmon
- http://www.osvdb.org/15781
- http://www.securityfocus.com/bid/13361