PT-2008-5994 · Aflog · Aflog

Joss · Publicado 2008-10-29 · Atualizado 2017-09-29 · CVE-2008-4784

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions aflog version 1.01

Description The issue allows remote attackers to bypass authentication and gain administrative access. This can be achieved by setting the aflog auth a cookie to "A" or "O" in several API endpoints, including "edit delete.php", "edit cat.php", "edit lock.php", and "edit form.php".

Recommendations For aflog version 1.01, as a temporary workaround, consider restricting access to the "edit delete.php", "edit cat.php", "edit lock.php", and "edit form.php" endpoints until a patch is available. Avoid using the aflog auth a cookie or restrict its value to prevent unauthorized access.

Exploit

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2008-4784

Produtos afetados

Aflog

Referências · 5

• 🔥 https://exploit-db.com/exploits/6818 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-4784 · Nota de Segurança
• http://securityreason.com/securityalert/4524 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46083 · Nota
• http://securityfocus.com/bid/31894 · Nota