PT-2005-5131 · Flatnuke · Flatnuke

Publicado 2005-12-21 · Atualizado 2017-07-20 · CVE-2005-4448

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FlatNuke version 2.5.6

Description The issue allows attackers to gain privileges by obtaining the password hash, then calculating the credentials and including them in the secid cookie. This is possible because FlatNuke verifies authentication credentials based on an MD5 checksum of the admin name and the hashed password rather than the plaintext password.

Recommendations For FlatNuke version 2.5.6, consider updating the authentication mechanism to verify credentials based on plaintext passwords instead of hashed passwords to prevent exploitation. As a temporary workaround, restrict access to the secid cookie to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2005-4448

Produtos afetados

Flatnuke

Referências · 6

• 🔥 http://securityfocus.com/archive/1/419107 · Exploit
• 🔥 http://securityfocus.com/bid/15796 · Exploit
• 🔥 http://securitytracker.com/id?1015339 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-4448 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/22159 · Nota
• http://cvs.sourceforge.net/viewcvs.py/flatnuke/flatnuke/Changelog?rev=1.78&view=markup · Nota