The sample files in the authfiles directory in Microsoft Commerce Server 2002 before SP2 allow remote attackers to bypass authentication by logging in to authfiles/login.asp with a valid username and any password, then going to the main site twice.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Commerce_server | Microsoft | 2002 (including) | 2002 (including) |
| Commerce_server | Microsoft | 2002-sp1 (including) | 2002-sp1 (including) |