Secunia

SlimTim10 has reported some vulnerabilities in Creasito E-Commerce Content Manager, which can be exploited by malicious people to bypass certain security restriction.

The vulnerabilities are caused due to an insecure authentication method in multiple files within the "admin" directory. This can be exploited to bypass authentication and access the administration section by providing an arbitrary, non-empty "finame" parameter.

The vulnerabilities are reported in version 1.3.08. Other versions may also be affected.

Solution
The vulnerability is reportedly fixed in an updated version 1.3.08 and later.

Provided and/or discovered by
SlimTim10

Changelog
Further details available in Customer Area

Original Advisory
http://milw0rm.com/exploits/2709

Deep Links
Links available in Customer Area