Description
Online Store System v1.0 delete_product.php doesn't check to see if a user authtenticated or has administrative rights allowing arbitrary product deletion.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| abcprintf | Online Store | unspecified – ≤ 1.0 | — |
References
- http://www.vapidlabs.com/advisory.php?v=210
- https://www.abcprintf.com/view_download.php?id=17
- [oss-security] 20191002 Multiple vulnerabilities in Online store system v1.0 Stored XSS and unauthenticated product deletions. mailing-list
- [oss-security] 20191223 Arbitrary file upload vulnerability in upload-image-with-ajax v1.0 mailing-list
- [oss-security] 20191223 Re: Arbitrary file upload vulnerability in upload-image-with-ajax v1.0 mailing-list