PT-2009-1993 · Openinvoice · Openinvoice

T0Pp8Uzz · Publicado 2009-03-25 · Atualizado 2017-09-29 · CVE-2008-6523

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions openInvoice versions 0.90 beta and earlier

Description The issue allows remote attackers to bypass authentication and gain privileges by setting the oiauth cookie. This can be combined with a separate vulnerability in resetpass.php to modify passwords for arbitrary users.

Recommendations For openInvoice versions 0.90 beta and earlier, consider disabling the authentication mechanism that uses the oiauth cookie until a patch is available. Restrict access to the resetpass.php file to minimize the risk of exploitation. Avoid using the oiauth cookie for authentication purposes until the issue is resolved.

Exploit

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2008-6523

Produtos afetados

Openinvoice

Referências · 4

• 🔥 http://securityfocus.com/bid/28854 · Exploit
• 🔥 https://exploit-db.com/exploits/5466 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41947 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-6523 · Nota de Segurança