medium5.0Public exploit code
CVE-2006-5428
rpc.php in Cerberus Helpdesk 3.2.1 does not verify a client's privileges for a display_get_requesters operation, which allows remote attackers to bypass the GU…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Cerberus Helpdesk 3.2.1 - 'Rpc.php' Unauthorized Access2006-10-18 · webapps · php · Verified
Impact
rpc.php in Cerberus Helpdesk 3.2.1 does not verify a client's privileges for a display_get_requesters operation, which allows remote attackers to bypass the GUI login and obtain sensitive information (ticket data) via a direct request.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Cerberus | Cerberus Helpdesk | Version 3.2.1 |
References
- NVD record
- CVE.org record
- http://forum.cerberusweb.com/showthread.php?t=7922
- http://secunia.com/advisories/22418
- http://www.securityfocus.com/bid/20598
- http://www.vupen.com/english/advisories/2006/4089
- https://exchange.xforce.ibmcloud.com/vulnerabilities/29655
- http://forum.cerberusweb.com/showthread.php?t=7922
- http://secunia.com/advisories/22418
- http://www.securityfocus.com/bid/20598
- http://www.vupen.com/english/advisories/2006/4089
- https://exchange.xforce.ibmcloud.com/vulnerabilities/29655