Futomi's CGI Cafe Search CGI Password Reset Security Bypass Vulnerability

Bugtraq ID:	33409
Class:	Access Validation Error
CVE:	CVE-2009-0469
Remote:	Yes
Local:	No
Published:	Jan 23 2009 12:00AM
Updated:	Feb 20 2009 04:27PM
Credit:	JPCERT/CC
Vulnerable:	Futomi's CGI Cafe Search CGI 1.1.2
Not Vulnerable:	Futomi's CGI Cafe Search CGI 1.1.3

Futomi's CGI Cafe Search CGI Password Reset Security Bypass Vulnerability

Futomi's CGI Cafe Search CGI is prone to a security-bypass vulnerability because it fails to adequately restrict access to the password-reset feature.

An attacker can exploit this issue to gain administrative access to the application, which may allow the attacker to compromise the application; other attacks are also possible.

Versions up to and including Futomi's CGI Cafe Search CGI 1.1.2 are vulnerable.

Futomi's CGI Cafe Search CGI Password Reset Security Bypass Vulnerability

Attackers can exploit this issue via a browser.

Futomi's CGI Cafe Search CGI Password Reset Security Bypass Vulnerability

Solution:
The vendor released Search CGI 1.1.3 to address this issue. Please see the references for more information.

Futomi's CGI Cafe Search CGI Password Reset Security Bypass Vulnerability

References:

• Vendor Homepage (Futomi CGI Cafe )
  
• futomi's CGI Cafe (JPCERT/CC)
  
• futomi's CGI Cafe Update (Futomi's CGI Cafe)