CVE-2009-3904

classes/session/cc_admin_session.php in CubeCart 4.3.4 does not properly restrict administrative access permissions, which allows remote attackers to bypass restrictions and gain administrative access via a HTTP request that contains an empty (1) sessID (ccAdmin cookie), (2) X_CLUSTER_CLIENT_IP header, or (3) User-Agent header.

• CWE-264

• http://forums.cubecart.com/index.php?showtopic=39691?read=1
• http://forums.cubecart.com/index.php?showtopic=39748Patch
• http://secunia.com/advisories/37197Vendor Advisory
• http://www.acunetix.com/blog/websecuritynews/cubecart-4-session-management-bypass-leads-to-administrator-access/Exploit
• http://www.securityfocus.com/archive/1/507594/100/0/threaded
• http://www.securityfocus.com/bid/36882Exploit
• http://www.securitytracker.com/id?1023120Exploit
• http://www.vupen.com/english/advisories/2009/3113Patch, Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54062
• http://forums.cubecart.com/index.php?showtopic=39691?read=1
• http://forums.cubecart.com/index.php?showtopic=39748Patch
• http://secunia.com/advisories/37197Vendor Advisory
• http://www.acunetix.com/blog/websecuritynews/cubecart-4-session-management-bypass-leads-to-administrator-access/Exploit
• http://www.securityfocus.com/archive/1/507594/100/0/threaded
• http://www.securityfocus.com/bid/36882Exploit
• http://www.securitytracker.com/id?1023120Exploit
• http://www.vupen.com/english/advisories/2009/3113Patch, Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54062

Published

Nov 6, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-3898Directory traversal vulnerability in src/http/modules/ngx_ht…
• CVE-2009-3899Memory leak in the Sockets Direct Protocol (SDP) driver in S…
• CVE-2009-3900Unspecified vulnerability in the Cluster Management componen…
• CVE-2009-3901Multiple cross-site scripting (XSS) vulnerabilities in e-Cou…
• CVE-2009-3902Directory traversal vulnerability in Cherokee Web Server 0.5…
• CVE-2009-3903Multiple cross-site scripting (XSS) vulnerabilities in jspui…
• CVE-2009-3905Multiple cross-site scripting (XSS) vulnerabilities in e-Cou…
• CVE-2009-3906Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2009-3907Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2009-3908Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2009-3909Integer overflow in the read_channel_data function in plug-i…
• CVE-2009-3911Cross-site scripting (XSS) vulnerability in settings.php in …