high7.5Public exploit code
CVE-2008-6523
auth.php in openInvoice 0.90 beta and earlier allows remote attackers to bypass authentication and gain privileges by setting the oiauth cookie.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- OpenInvoice 0.9 - Arbitrary Change User Password2008-04-18 · webapps · php · Verified
Impact
auth.php in openInvoice 0.90 beta and earlier allows remote attackers to bypass authentication and gain privileges by setting the oiauth cookie. NOTE: this can be leveraged with a separate vulnerability in resetpass.php to modify passwords for arbitrary users.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Cale Dunlap | Openinvoice | Version 0.90 |