Description
orderdetails.aspx, as made available to Microsoft .NET developers as example code and demonstrated on www.ibuyspystore.com, allows remote attackers to view the orders of other users by modifying the OrderID parameter.
References (1)
Core 1
Core References
Mailing List mailing-list
x_refsource_bugtraq
http://marc.info/?l=bugtraq&m=101518860823788&w=2
Scores
EPSS
0.1932
EPSS Percentile
97.1%
Details
Status
published
Products (1)
microsoft/.net_framework
1.0
Published
Jul 26, 2002
Tracked Since
Feb 18, 2026