CVE-2006-1257 Auth bypass in n/a

High 7.5 Published 19 Mar 2006 Updated 7 Aug 2024

Remote attackers can bypass authentication in Microsoft Commerce Server by exploiting sample files, allowing unauthorized access to the main site.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2006-1257?

CVE-2006-1257 is a high-severity authentication bypass vulnerability in n/a, published on 19 Mar 2006. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The sample files in the authfiles directory in Microsoft Commerce Server 2002 before SP2 allow remote attackers to bypass authentication by logging in to authfiles/login.asp with a valid username and any password, then going to the main site twice.

Which versions are affected by CVE-2006-1257?

It affects 1 product.

Products include Microsoft Commerce Server.

How do I fix CVE-2006-1257?

No fix has been published for CVE-2006-1257 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2006-1257 being exploited?

There is no known exploitation of CVE-2006-1257 in the wild and no public exploit code.

Sources

Also known as GHSA-j7hg-4m8w-qjr3.