1126
Reference Description
CVE-2002-0108 Forum product allows spoofed messages of other users via hidden form fields
for name and e-mail address.
https://www.cve.org/CVERecord?id=CVE-2002-0108
CVE-2000-0253 Shopping cart allows price modification via hidden form field.
https://www.cve.org/CVERecord?id=CVE-2000-0253
CVE-2000-0254 Shopping cart allows price modification via hidden form field.
https://www.cve.org/CVERecord?id=CVE-2000-0254
CVE-2000-0926 Shopping cart allows price modification via hidden form field.
https://www.cve.org/CVERecord?id=CVE-2000-0926
CVE-2000-0101 Shopping cart allows price modification via hidden form field.
https://www.cve.org/CVERecord?id=CVE-2000-0101
CVE-2000-0102 Shopping cart allows price modification via hidden form field.
https://www.cve.org/CVERecord?id=CVE-2000-0102
CVE-2000-0758 Allows admin access by modifying value of form field.
https://www.cve.org/CVERecord?id=CVE-2000-0758
CVE-2002-1880 Read messages by modifying message ID parameter.
https://www.cve.org/CVERecord?id=CVE-2002-1880
CVE-2000-1234 Send email to arbitrary users by modifying email parameter.
https://www.cve.org/CVERecord?id=CVE-2000-1234
CVE-2005-1652 Authentication bypass by setting a parameter.
https://www.cve.org/CVERecord?id=CVE-2005-1652
CVE-2005-1784 Product does not check authorization for configuration change admin script,
leading to password theft via modified e-mail address field.
https://www.cve.org/CVERecord?id=CVE-2005-1784
CVE-2005-2314 Logic error leads to password disclosure.
https://www.cve.org/CVERecord?id=CVE-2005-2314
CVE-2005-1682 Modification of message number parameter allows attackers to read other
people's messages.
https://www.cve.org/CVERecord?id=CVE-2005-1682
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 715 OWASP Top Ten 2007 Category A4 - Insecure Direct
Object Reference
629 2331
MemberOf 722 OWASP Top Ten 2004 Category A1 - Unvalidated Input 711 2334
MemberOf 991 SFP Secondary Cluster: Tainted Input to Environment 888 2416
MemberOf 1348 OWASP Top Ten 2021 Category A04:2021 - Insecure
Design
1344 2491
MemberOf 1403 Comprehensive Categorization: Exposed Resource 1400 2528
Notes
Relationship
This is a primary weakness for many other weaknesses and functional consequences, including
XSS, SQL injection, path disclosure, and file inclusion.
Theoretical
This is a technology-specific MAID problem.
Taxonomy Mappings
CWE Version 4.14
CWE-473: PHP External Variable Modification
CWE-473: PHP External Variable Modification