Hinton Design PHPHD Multiple Input Validation And Authentication Bypass Vulnerabilities
BID:16586
Info
Hinton Design PHPHD Multiple Input Validation And Authentication Bypass Vulnerabilities
| Bugtraq ID: | 16586 |
| Class: | Input Validation Error |
| CVE: |
CVE-2006-0607 CVE-2006-0608 CVE-2006-0609 |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 10 2006 12:00AM |
| Updated: | Dec 13 2006 11:33AM |
| Credit: | Aliaksandr Hartsuyeu is credited with the discovery of these issues. |
| Vulnerable: |
Hinton Design phphd 1.0 |
| Not Vulnerable: | |
Discussion
Hinton Design PHPHD Multiple Input Validation And Authentication Bypass Vulnerabilities
The 'phphd' application is prone to multiple input-validation vulnerabilities. These issues are due to failures in the application to properly sanitize user-supplied input.
Successful exploitation could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or possibly control how the site is rendered to the user.
Attackers may be also able to exploit vulnerabilities in the underlying database implementation and conduct other attacks.
Some of these issues may be related to those discussed in BID 16541 (Hinton Design PHPHG Guestbook Multiple Input Validation Vulnerabilities) and BID 16528 (Hinton Design PHPStatus Username SQL Injection Vulnerability).
The 'phphd' application is prone to multiple input-validation vulnerabilities. These issues are due to failures in the application to properly sanitize user-supplied input.
Successful exploitation could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or possibly control how the site is rendered to the user.
Attackers may be also able to exploit vulnerabilities in the underlying database implementation and conduct other attacks.
Some of these issues may be related to those discussed in BID 16541 (Hinton Design PHPHG Guestbook Multiple Input Validation Vulnerabilities) and BID 16528 (Hinton Design PHPStatus Username SQL Injection Vulnerability).
Exploit / POC
Hinton Design PHPHD Multiple Input Validation And Authentication Bypass Vulnerabilities
An exploit is not required.
An exploit is not required.
Solution / Fix
Hinton Design PHPHD Multiple Input Validation And Authentication Bypass Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Hinton Design PHPHD Multiple Input Validation And Authentication Bypass Vulnerabilities
References:
References:
- phphd Home Page (Hinton Design)
- phphd Multiple Vulnerabilities (Aliaksandr Hartsuyeu)
- [eVuln] phphd Multiple Vulnerabilities ([email protected])