PT-2002-2542 · Unknown · Ultimate Php Board

Published 2002-12-31 · Updated 2024-02-15 · CVE-2002-1820

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Ultimate PHP Board (UPB) versions 1.0 and 1.0b

Description The issue allows a remote attacker to impersonate the administrator by registering an account name of admin with a lower case "a", since the administrative account Admin with a capital "A" is used in register.php.

Recommendations For Ultimate PHP Board (UPB) versions 1.0 and 1.0b, consider modifying the register.php script to prevent registration of the admin account name in any case, or restrict access to administrative functions to prevent impersonation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-178

Related Identifiers

CVE-2002-1820

Affected Products

Ultimate Php Board

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2002-1820 · Security Note
• http://iss.net/security_center/static/9972.php · Patch
• http://securityfocus.com/bid/5580 · Note
• http://securityfocus.com/archive/1/289417 · Note
• https://t.me/cvenotify/71668 · Telegram Post