Description
The process function in data/class/pages/admin/customer/LC_Page_Admin_Customer_SearchCustomer.php in EC-CUBE Ver2 2.4.0 RC1 through 2.4.1, and Community Edition r18068 through r18428, allows remote attackers to obtain sensitive information (customer data) via unknown vectors related to sessions.
References
- ADV-2009-3421 vdb-entry
- 37603 third-party-advisory
- JVN#79762947 third-party-advisory
- 60685 vdb-entry
- eccube-searchcustomer-security-bypass(54573) vdb-entry
- JVNDB-2009-000078 third-party-advisory
- http://www.ipa.go.jp/security/vuln/documents/2009/200912_ec-cube.html
- http://www.ec-cube.net/info/091127/