TinyPHPForum UpdatePF.PHP Authentication Bypass Vulnerability
BID:19281
Info
TinyPHPForum UpdatePF.PHP Authentication Bypass Vulnerability
| Bugtraq ID: | 19281 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 01 2006 12:00AM |
| Updated: | Apr 01 2009 11:36PM |
| Credit: | SirDarckCat is credited with the discovery of this vulnerability. |
| Vulnerable: |
TinyPHPForum TinyPHPForum 3.6 TinyPHPForum TinyPHPForum 3.61 |
| Not Vulnerable: | |
Discussion
TinyPHPForum UpdatePF.PHP Authentication Bypass Vulnerability
TinyPHPForum is prone to an authentication-bypass vulnerability because it fails to prevent an attacker from accessing admin scripts directly without requiring authentication.
A remote attacker can exploit this issue to perform administrative functions without requiring authentication. For example, the attacker may be able to create administrative users for the affected application.
TinyPHPForum is prone to an authentication-bypass vulnerability because it fails to prevent an attacker from accessing admin scripts directly without requiring authentication.
A remote attacker can exploit this issue to perform administrative functions without requiring authentication. For example, the attacker may be able to create administrative users for the affected application.
Exploit / POC
TinyPHPForum UpdatePF.PHP Authentication Bypass Vulnerability
Attackers can exploit this issue via a browser.
The following proof-of-concept HTML code and example HTTP POST request are available:
Attackers can exploit this issue via a browser.
The following proof-of-concept HTML code and example HTTP POST request are available:
Solution / Fix
TinyPHPForum UpdatePF.PHP Authentication Bypass Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
TinyPHPForum UpdatePF.PHP Authentication Bypass Vulnerability
References:
References:
- TinyPHPForum Project Page (TinyPHPForum)