CVE-2009-4236

The process function in data/class/pages/admin/customer/LC_Page_Admin_Customer_SearchCustomer.php in EC-CUBE Ver2 2.4.0 RC1 through 2.4.1, and Community Edition r18068 through r18428, allows remote attackers to obtain sensitive information (customer data) via unknown vectors related to sessions.

• CWE-200

• http://jvn.jp/en/jp/JVN79762947/index.html
• http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-000078.html
• http://osvdb.org/60685
• http://secunia.com/advisories/37603Vendor Advisory
• http://www.ec-cube.net/info/091127/Patch, Vendor Advisory
• http://www.ipa.go.jp/security/vuln/documents/2009/200912_ec-cube.html
• http://www.vupen.com/english/advisories/2009/3421Patch, Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54573
• http://jvn.jp/en/jp/JVN79762947/index.html
• http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-000078.html
• http://osvdb.org/60685
• http://secunia.com/advisories/37603Vendor Advisory
• http://www.ec-cube.net/info/091127/Patch, Vendor Advisory
• http://www.ipa.go.jp/security/vuln/documents/2009/200912_ec-cube.html
• http://www.vupen.com/english/advisories/2009/3421Patch, Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54573

Published

Dec 8, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-4230Multiple stack-based buffer overflows in src/Task.cc in the …
• CVE-2009-4231Directory traversal vulnerability in as/lib/plugins.php in S…
• CVE-2009-4232The Kide Shoutbox (com_kide) component 0.4.6 for Joomla! doe…
• CVE-2009-4233Cross-site scripting (XSS) vulnerability in modules/mod_yj_w…
• CVE-2009-4234Cross-site scripting (XSS) vulnerability in loginpages/error…
• CVE-2009-4235acpid 1.0.4 sets an unrestrictive umask, which might allow l…
• CVE-2009-4237Multiple cross-site scripting (XSS) vulnerabilities in TestL…
• CVE-2009-4238Multiple SQL injection vulnerabilities in TestLink before 1.…
• CVE-2009-4239Cross-site scripting (XSS) vulnerability in the Web console …
• CVE-2009-4240Multiple buffer overflows in unspecified setuid executables …
• CVE-2009-4241Heap-based buffer overflow in RealNetworks RealPlayer 10, Re…
• CVE-2009-4242Heap-based buffer overflow in the CGIFCodec::GetPacketBuffer…