This issue enabled attacker to obtain address (name, address, phone), previous order (items, amounts) and payment method (payment method, recurrence) information from the recurring payment profiles of other store customers.The attacker just create an account with the store. While viewing own recurring profile, the attacker can request an arbitrary recurring profile using a sequential ID. The information was then returned to the attacker.This attack could be fully automated, and a manual proof of concept exists.
Part of patch SUPEE-5994
This vulnerability affects the following application versions:
- Magento 1.4.1.0
- Magento 1.4.1.1
- Magento 1.4.2.0
- Magento 1.5.0.1
- Magento 1.5.1.0
- Magento 1.6.0.0
- Magento 1.6.1.0
- Magento 1.6.2.0
- Magento 1.7.0.0
- Magento 1.7.0.1
- Magento 1.7.0.2
- Magento 1.8.0.0
- Magento 1.8.1.0
- Magento 1.9.0.0
- Magento 1.9.0.1
- Magento 1.9.1.0
- Magento 1.9.1.1