CVE-2013-6788

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-05-30 · updated 2026-06-17
Weakness: CWE-287

Description

The Bitrix e-Store module before 14.0.1 for Bitrix Site Manager uses sequential values for the BITRIX_SM_SALE_UID cookie, which makes it easier for remote attackers to guess the cookie value and bypass authentication via a brute force attack.

Affected products

Bitrix E-Store Module: through 14.0.0

References

http://secunia.com/advisories/56033
http://www.bitrixsoft.com/products/cms/versions.php?module=sale
http://www.securityfocus.com/bid/63606
https://www.htbridge.com/advisory/HTB23183
http://secunia.com/advisories/56033
http://www.bitrixsoft.com/products/cms/versions.php?module=sale
http://www.securityfocus.com/bid/63606
https://www.htbridge.com/advisory/HTB23183

Get alerted when CVE-2013-6788 or the next vulnerability affects your stack