Remote Code Execution in Shopizer Webshop by Insecure User Account Management
CVE-2014-4963

Currently unrated

Key Information:

Vendor

Shopizer

Status
Shopizer
Vendor
CVE Published:
15 July 2014

What is CVE-2014-4963?

The Shopizer Webshop contains a vulnerability that allows remote attackers to manipulate user account settings due to improper validation of the customer.customerId parameter. This flaw can be exploited by an attacker to access and alter the account details of arbitrary users, posing significant risks to user data integrity and privacy. Implementing proper input validation and sanitization is crucial to mitigate this vulnerability.

References

http://www.securityfocus.com/archive/1/532726/100/0/threaded
mailing-listx_refsource_BUGTRAQ
http://seclists.org/fulldisclosure/2014/Jul/38
mailing-listx_refsource_FULLDISC

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.