NetSight
IP …
medium6.8Public exploit code

CVE-2009-1283

glFusion before 1.1.3 performs authentication with a user-provided password hash instead of a password, which allows remote attackers to gain privileges by obt…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

glFusion before 1.1.3 performs authentication with a user-provided password hash instead of a password, which allows remote attackers to gain privileges by obtaining the hash and using it in the glf_password cookie, aka "User Masquerading." NOTE: this can be leveraged with a separate SQL injection vulnerability to steal hashes.

Affected products

VendorProductAffected versions
GlfusionGlfusion
through 1.1.2
Versions 1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.1.1

Weakness classification

CWE-310

References