CVEvulnerability
CVE-2006-1257
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2006-03-19
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Description
The sample files in the authfiles directory in Microsoft Commerce Server 2002 before SP2 allow remote attackers to bypass authentication by logging in to authfiles/login.asp with a valid username and any password, then going to the main site twice.
Affected configurations
• microsoft commerce server 2002
References
- http://msdn.microsoft.com/library/default.asp?url=/library/en-us/csvr2002/htm/cs_se_securityconcepts_cbgw.asp msdn.microsoft.com
- http://securityreason.com/securityalert/594 securityreason.com
- http://www.osvdb.org/24121 www.osvdb.org
- http://www.securityfocus.com/archive/1/427974/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/17134 Patch
- https://exchange.xforce.ibmcloud.com/vulnerabilities/25330 exchange.xforce.ibmcloud.com
- http://msdn.microsoft.com/library/default.asp?url=/library/en-us/csvr2002/htm/cs_se_securityconcepts_cbgw.asp msdn.microsoft.com
- http://securityreason.com/securityalert/594 securityreason.com
- http://www.osvdb.org/24121 www.osvdb.org
- http://www.securityfocus.com/archive/1/427974/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/17134 Patch
- https://exchange.xforce.ibmcloud.com/vulnerabilities/25330 exchange.xforce.ibmcloud.com