high7.5Public exploit code
CVE-2008-1971
phShoutBox Final 1.5 and earlier only checks passwords when specified in $_POST, which allows remote attackers to gain privileges by setting the (1) phadmin co…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- PhShoutBox 1.5 - Insecure Cookie Handling2008-04-18 · webapps · php · Verified
Impact
phShoutBox Final 1.5 and earlier only checks passwords when specified in $_POST, which allows remote attackers to gain privileges by setting the (1) phadmin cookie to admin.php, or (2) in 1.4 and earlier, the ssbadmin cookie to shoutadmin.php.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Phphq | Phshoutbox Final | through 1.5 |
Weakness classification
References
- NVD record
- CVE.org record
- http://secunia.com/advisories/29892
- http://www.securityfocus.com/bid/28856
- https://exchange.xforce.ibmcloud.com/vulnerabilities/41901
- https://www.exploit-db.com/exploits/5467
- http://secunia.com/advisories/29892
- http://www.securityfocus.com/bid/28856
- https://exchange.xforce.ibmcloud.com/vulnerabilities/41901
- https://www.exploit-db.com/exploits/5467