PT-2005-5522 · Gravity Interactive · Ragnarok Online Control Panel

Publicado

2005-12-31

·

Atualizado

2008-09-05

·

CVE-2005-4861

CVSS v2.0

7.5

Alta

VetorAV:N/AC:L/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions: Ragnarok Online Control Panel (ROCP) version 4.3.4a
Description: The issue allows remote attackers to bypass authentication. This is achieved by requesting account manage.php with a trailing /login.php PHP SELF value, which is not properly handled by the CHECK AUTH function.
Recommendations: For Ragnarok Online Control Panel (ROCP) version 4.3.4a, consider modifying the CHECK AUTH function to properly handle the PHP SELF value, specifically to prevent bypassing authentication when a trailing /login.php is requested. As a temporary workaround, restrict access to the account manage.php endpoint to minimize the risk of exploitation.

Correção

Improper Authentication

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2005-4861

Produtos afetados

Ragnarok Online Control Panel