MyPHP Forum Privmsg.PHP Username Spoofing Vulnerability
BID:13430
Info
MyPHP Forum Privmsg.PHP Username Spoofing Vulnerability
| Bugtraq ID: | 13430 |
| Class: | Design Error |
| CVE: |
CVE-2005-1404 |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 28 2005 12:00AM |
| Updated: | Jul 12 2009 02:06PM |
| Credit: | Discovery of this issue is credited to Terencentanio Enache. |
| Vulnerable: |
MyPHP Forum MyPHP Forum 1.0 |
| Not Vulnerable: | |
Discussion
MyPHP Forum Privmsg.PHP Username Spoofing Vulnerability
MyPHP Forum is prone to a username spoofing vulnerability. The issue exists due to a design error, where a user may arbitrarily specify their username as a value for a URI parameter while submitting a message to the forum.
An attacker may exploit this issue to spoof forum messages from other, potentially trusted, users.
MyPHP Forum is prone to a username spoofing vulnerability. The issue exists due to a design error, where a user may arbitrarily specify their username as a value for a URI parameter while submitting a message to the forum.
An attacker may exploit this issue to spoof forum messages from other, potentially trusted, users.
Exploit / POC
MyPHP Forum Privmsg.PHP Username Spoofing Vulnerability
No exploit is required.
No exploit is required.
Solution / Fix
MyPHP Forum Privmsg.PHP Username Spoofing Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
MyPHP Forum Privmsg.PHP Username Spoofing Vulnerability
References:
References:
- MyPHP Forum Homepage (MyPHP Forum)