Security issue?

robgrigg · Post by **robgrigg** » Sat Oct 10, 2009 1:24 am

Hi,
whilst making some modifications to the reciept page I noticed that the order shown is controlled by the open query string.

Checkout/Receipt.aspx?OrderNumber=18&OrderId=118

by simply changing this to;

Checkout/Receipt.aspx?OrderNumber=17&OrderId=117

I was able to see an order for a different user. I am sure this has been addressed, can you please let me know what to do to remove this issue.

Cheers,

Rob.

Post by **mazhar** » Sat Oct 10, 2009 4:30 am

I am unable to reproduce it on 7.0.3. What is your application version?

jmestep · Post by **jmestep** » Sat Oct 10, 2009 6:21 am

I was unable to reproduce on 7.0.2. Have you changed the web.config file in the members folder where it denies all users except on the wishlist?

igavemybest · Post by **igavemybest** » Sat Oct 10, 2009 9:40 am

Can you do this just when logged is as an admin? You said you were modifying something. Try it not logged in as an admin.

AbleCommerce Shopping Cart Software

Security issue?

Security issue?

Re: Security issue?

Re: Security issue?

Re: Security issue?