EC-CUBE Multi-Factor Authentication Bypass Vulnerability

A vulnerability allowing multi-factor authentication (MFA) bypass has been identified in EC-CUBE versions 4.1 series prior to 4.1.2-p5, 4.2 series prior to 4.2.3-p2, and 4.3 series prior to 4.3.1-p1. This vulnerability allows an attacker with a valid administrator ID and password to bypass two-factor authentication and gain unauthorized access to the administrative page.

Impact

Exploitation of this vulnerability allows for unauthorized access to the administrative page by bypassing two-factor authentication.

Reproduction

To reproduce this vulnerability, an attacker must obtain a valid administrator ID and password. Once these credentials are acquired, they can log into the administrative page and bypass the two-factor authentication process, gaining unauthorized access.

Remediation

Users can apply the appropriate patch for their EC-CUBE version. Patch files for versions 4.1.2-p5, 4.2.3-p2, and 4.3.1-p1 are available on the EC-CUBE website.