Wuff MovieDB Password Disclosure Vulnerability

Bugtraq ID:	3823
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Jan 05 2002 12:00AM
Updated:	Jan 05 2002 12:00AM
Credit:	Published in the Wuff MovieDB changelog on January 5, 2002.
Vulnerable:	Wuff MovieDB 1.35
Not Vulnerable:	Wuff MovieDB 1.36

Wuff MovieDB Password Disclosure Vulnerability

Wuff MovieDB is a MySQL-Database which enables users to catalogue various media type files (VCD, SVCD, DVD, movies) with cover art. MovieDB includes a PHP front end to access and modify the database content.

Due to a flaw in MovieDB, a user can gain knowledge of another user's password.

This is achievable when a user is logging into the program. MovieDB is designed in such a way that when a user attempts to log into the program, the password field does not conceal the password, with for example asterisks. The password entered is in plain text, any on lookers may clearly read the authentication info and log in as that user.

Wuff MovieDB Password Disclosure Vulnerability

No exploit code is required.

Wuff MovieDB Password Disclosure Vulnerability

Solution:
Wuff has addressed this in MovieDB 1.36:


Wuff MovieDB 1.35

• Wuff Wuffs_MovieDB_1.36
  http://prdownloads.sourceforge.net/wuffs-moviedb/Wuffs_MovieDB_1.36.zi p

Wuff MovieDB Password Disclosure Vulnerability

References:

• MovieDB Changelog (Wuff)
  
• Wuff Homepage (Wuff)