NetSight
IP …
high7.5

CVE-2006-5474

The "forgot password" function in OneOrZero Helpdesk before 1.6.5.4 generates insecure passwords by concatenating the current timestamp with the username, whic…

Impact

The "forgot password" function in OneOrZero Helpdesk before 1.6.5.4 generates insecure passwords by concatenating the current timestamp with the username, which allows remote attackers to gain access as an arbitrary user by requesting a password reset.

Affected products

VendorProductAffected versions
OneorzeroOneorzero Helpdesk
through 1.6.5.3
Versions 1.6, 1.6.3, 1.6.4

References