PT-2002-2888 · Phpsquidpass · Phpsquidpass

Published 2002-12-31 · Updated 2016-10-18 · CVE-2002-2175

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions: phpSquidPass versions prior to 0.2

Description: The issue allows remote authenticated attackers to effectively delete other usernames via a short username that matches the end of the targeted username, due to an incomplete regular expression used to find a matching username in the database.

Recommendations: For versions prior to 0.2, update to version 0.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the username management functionality to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2002-2175

Affected Products

Phpsquidpass

References · 5

• http://iss.net/security_center/static/9417.php · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-2175 · Security Note
• http://securityfocus.com/bid/5090 · Vendor Advisory
• http://sourceforge.net/forum/forum.php?forum_id=188359 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=102508071021631&w=2 · Note