AV Arcade Cookie[ava_userid] Authentication Bypass Vulnerability

Bugtraq ID:	24736
Class:	Access Validation Error
CVE:	CVE-2007-3643
Remote:	Yes
Local:	No
Published:	Jul 02 2007 12:00AM
Updated:	May 07 2015 05:37PM
Credit:	Kw3rln is credited with the discovery of this vulnerability.
Vulnerable:	AV Scripts AV Arcade 2.1b
Not Vulnerable:

AV Arcade Cookie[ava_userid] Authentication Bypass Vulnerability

AV Arcade is prone to an authentication-bypass vulnerability because the application fails to check user privileges when accessing the administration pages.

An attacker can exploit this issue to compromise the application, which may aid in further attacks.

AV Arcade 2.1b is vulnerable; other versions may also be affected.

AV Arcade Cookie[ava_userid] Authentication Bypass Vulnerability

Attackers can exploit this issue via a browser.

AV Arcade Cookie[ava_userid] Authentication Bypass Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

AV Arcade Cookie[ava_userid] Authentication Bypass Vulnerability

References:

• Vendor Homepage (AV Scripts)
  
• AV Arcade 2.1b (COOKIE[ava_userid]) Get Admin Rights (Kw3rLn)