CVE-2002-2303

HighCVSS 7.8/10Last modified Jun 16, 2026

Description

3D3.Com ShopFactory 5.8 uses client-side encryption and decryption for sensitive price data, which allows remote attackers to modify shopping cart prices by using the Javascript to decrypt the cookie that contains the data.

Metrics

CVSS 2.0 7.8/10AV:N/AC:L/Au:N/C:N/I:C/A:N

Weakness enumeration

CWE-310

Affected software

No affected versions have been published.

Timeline

Published
Dec 31, 2002
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2002

CVE-2002-23047.5SQL injection vulnerability in admin/auth/checksession.php in MyPHPLinks 2.1.9 and 2.2.0 allows remote attackers to execute arbitrary SQL coCVE-2002-23057.5SQL injection vulnerability in agentadmin.php in Immobilier allows remote attackers to execute arbitrary SQL commands via the (1) agentname CVE-2002-23067.8Sharman Networks KaZaA Media Desktop 1.7.1 allows remote attackers to cause a denial of service (CPU consumption) by sending several large mCVE-2002-23075.0The default configuration of BenHur Firewall release 3 update 066 fix 2 allows remote attackers to access arbitrary services by connecting fCVE-2002-23085.0Netscape Communicator 6.2.1 allows remote attackers to cause a denial of service in client browsers via a webpage containing a recursive METCVE-2002-23097.8php.exe in PHP 3.0 through 4.2.2, when running on Apache, does not terminate properly, which allows remote attackers to cause a denial of seCVE-2002-23105.0ClickCartPro 4.0 stores the admin_user.db data file under the web document root with insufficient access control on servers other than ApachCVE-2002-23116.4Microsoft Internet Explorer 6.0 and possibly others allows remote attackers to upload arbitrary file contents when users press a key correspCVE-2002-23125.8Opera 6.0.1 allows remote attackers to upload arbitrary file contents when users press a key corresponding to the JavaScript (1) event.ctrlKCVE-2002-23138.8Eudora email client 5.1.1, with "use Microsoft viewer" enabled, allows remote attackers to execute arbitrary programs via an HTML email messCVE-2002-23145.0Mozilla 1.0 allows remote attackers to steal cookies from other domains via a javascript: URL with a leading "//" and ending in a newline, wCVE-2002-23157.8Cisco IOS 11.2.x and 12.0.x does not limit the size of its redirect table, which allows remote attackers to cause a denial of service (memor
CVE-2002-2303: High severity, CVSS 7.8 | Vulnix