Unrated severityNVD Advisory· Published Mar 19, 2006· Updated Apr 16, 2026

CVE-2006-1257

Description

The sample files in the authfiles directory in Microsoft Commerce Server 2002 before SP2 allow remote attackers to bypass authentication by logging in to authfiles/login.asp with a valid username and any password, then going to the main site twice.

Affected products

Microsoft/Commerce Server2 versions
cpe:2.3:a:microsoft:commerce_server:2002:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:microsoft:commerce_server:2002:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:commerce_server:2002:sp1:*:*:*:*:*:*

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

www.securityfocus.com/bid/17134nvdPatch
msdn.microsoft.com/library/default.aspnvd
securityreason.com/securityalert/594nvd
www.osvdb.org/24121nvd
www.securityfocus.com/archive/1/427974/100/0/threadednvd
exchange.xforce.ibmcloud.com/vulnerabilities/25330nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.026
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000