PT-2008-2023 · Alitalk · Alitalk

Tomplixsee · Publicado 2008-01-23 · Atualizado 2017-09-29 · CVE-2008-0391

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions aliTalk version 1.9.1.1

Description The issue concerns improper authentication verification in the inc/elementz.php file, allowing remote attackers to add arbitrary user accounts. This is achieved by modifying the lilil parameter, in conjunction with the ubild and pa parameters.

Recommendations For aliTalk version 1.9.1.1, consider restricting access to the inc/elementz.php file until a proper fix is available, and avoid using the lilil, ubild, and pa parameters in a way that could facilitate unauthorized user account additions.

Exploit

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2008-0391

Produtos afetados

Alitalk

Referências · 3

• 🔥 https://exploit-db.com/exploits/4922 · Exploit
• http://securityfocus.com/bid/27315 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-0391 · Nota de Segurança