critical9.8Public exploit code
CVE-2005-0408
CitrusDB 0.3.6 and earlier generates easily predictable MD5 hashes of the user name for the id_hash cookie, which allows remote attackers to bypass authenticat…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- CitrusDB 0.3.6 - Remote Authentication Bypass2004-02-15 · webapps · php · Verified
Impact
CitrusDB 0.3.6 and earlier generates easily predictable MD5 hashes of the user name for the id_hash cookie, which allows remote attackers to bypass authentication and gain privileges by calculating the MD5 checksum of the user name combined with the "boogaadeeboo" string, which is hard-coded in the $hidden_hash variable.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Citrusdb | Citrusdb | through 0.3.6 |
Weakness classification
References
- NVD record
- CVE.org record
- http://lists.grok.org.uk/pipermail/full-disclosure/2005-February/031707.html
- http://www.redteam-pentesting.de/advisories/rt-sa-2005-002.txt
- http://lists.grok.org.uk/pipermail/full-disclosure/2005-February/031707.html
- http://www.redteam-pentesting.de/advisories/rt-sa-2005-002.txt