PT-2005-5131 · Flatnuke · Flatnuke

Published 2005-12-21 · Updated 2017-07-20 · CVE-2005-4448

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FlatNuke version 2.5.6

Description The issue allows attackers to gain privileges by obtaining the password hash, then calculating the credentials and including them in the secid cookie. This is possible because FlatNuke verifies authentication credentials based on an MD5 checksum of the admin name and the hashed password rather than the plaintext password.

Recommendations For FlatNuke version 2.5.6, consider updating the authentication mechanism to verify credentials based on plaintext passwords instead of hashed passwords to prevent exploitation. As a temporary workaround, restrict access to the secid cookie to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2005-4448

Affected Products

Flatnuke

References · 6

• 🔥 http://securityfocus.com/archive/1/419107 · Exploit
• 🔥 http://securityfocus.com/bid/15796 · Exploit
• 🔥 http://securitytracker.com/id?1015339 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-4448 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/22159 · Note
• http://cvs.sourceforge.net/viewcvs.py/flatnuke/flatnuke/Changelog?rev=1.78&view=markup · Note