PT-2009-2519 · Blizzard+1 · Wow Raid Manager+1

Publicado 2009-08-24 · Atualizado 2009-08-24 · CVE-2008-7050

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions WoW Raid Manager version 3.5.1

Description The issue concerns the password check function in the auth/auth phpbb3.php file when using PHPBB3 authentication. It has two main problems: (1) it does not correctly invoke the CheckPassword function with the necessary arguments, leading to authentication failures, and (2) it returns true instead of false when an authentication failure occurs. This allows remote attackers to bypass authentication with any password, potentially gaining privileges.

Recommendations For WoW Raid Manager version 3.5.1, apply Patch 1 to fix the authentication bypass issue in the password check function.

Exploit

Correção

Enumeração de Fraquezas

CWE-255

Identificadores relacionados

CVE-2008-7050

Produtos afetados

Phpbb3

Wow Raid Manager

Referências · 8

• 🔥 http://github.com/Illydth/wowraidmanager/commit/7dd6367ae85003dd5d715431b6ab695f2c2f200a · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-7050 · Nota
• http://secunia.com/advisories/32653 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2008-7050 · Nota de Segurança
• http://osvdb.org/49704 · Nota
• http://wowraidmanager.net/e107_plugins/forum/forum_viewtopic.php?2167 · Aviso do Fabricante
• http://vupen.com/english/advisories/2008/3109 · Aviso do Fabricante
• http://wowraidmanager.net/e107_plugins/forum/forum_viewtopic.php?2153 · Aviso do Fabricante