OpenForum 'profile.php' Authentication Bypass Vulnerability
BID:32536
Info
OpenForum 'profile.php' Authentication Bypass Vulnerability
| Bugtraq ID: | 32536 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 29 2008 12:00AM |
| Updated: | Dec 01 2008 11:52PM |
| Credit: | CWH Underground |
| Vulnerable: |
OpenForum OpenForum 0.66 |
| Not Vulnerable: | |
Discussion
OpenForum 'profile.php' Authentication Bypass Vulnerability
OpenForum is prone to a vulnerability that lets attackers modify arbitrary user passwords because it fails to adequately secure access to administrative functionality.
This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.
OpenForum 0.66 is vulnerable; other versions may also be affected.
OpenForum is prone to a vulnerability that lets attackers modify arbitrary user passwords because it fails to adequately secure access to administrative functionality.
This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.
OpenForum 0.66 is vulnerable; other versions may also be affected.
Exploit / POC
OpenForum 'profile.php' Authentication Bypass Vulnerability
Attackers can exploit this issue via a browser.
The following exploit is available:
Attackers can exploit this issue via a browser.
The following exploit is available:
Solution / Fix
OpenForum 'profile.php' Authentication Bypass Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
OpenForum 'profile.php' Authentication Bypass Vulnerability
References:
References:
- OpenForum Homepage (OpenForum)