MetaBBS Administration Settings Authentication Bypass Vulnerability

Bugtraq ID:	33626
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 04 2009 12:00AM
Updated:	Feb 06 2009 08:18PM
Credit:	[email protected]
Vulnerable:	MetaBBS MetaBBS 0.11
Not Vulnerable:

MetaBBS Administration Settings Authentication Bypass Vulnerability

MetaBBS is prone to a vulnerability that lets attackers modify arbitrary user passwords because it fails to adequately secure access to administrative functionality.

Exploiting this issue may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

MetaBBS 0.11 is vulnerable; other versions may also be affected.

MetaBBS Administration Settings Authentication Bypass Vulnerability

Attackers can exploit this issue via a browser.

The following exploit is available:

• /data/vulnerabilities/exploits/33626.html

MetaBBS Administration Settings Authentication Bypass Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

MetaBBS Administration Settings Authentication Bypass Vulnerability

References:

• MetaBBS Homepage (MetaBBS)
  
• metabbs 0.11 Change admin password vulnerability ([email protected])