Description
The ProcessLogin function in class.auth.php in Interspire Shopping Cart (ISC) 4.0.1 Ultimate edition allows remote attackers to bypass authentication and obtain administrative access by reusing the RememberToken cookie after a failed admin login attempt.
References
- 1021557 vdb-entry
- 33212 vdb-entry
- 20090112 [BMSA-2009-01] Authentication bypass in Interspire Shopping Cart v4.0.1 and below mailing-list
- interspire-classauth-security-bypass(47899) vdb-entry