PT-2008-2023 · Alitalk · Alitalk

Tomplixsee · Published 2008-01-23 · Updated 2017-09-29 · CVE-2008-0391

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions aliTalk version 1.9.1.1

Description The issue concerns improper authentication verification in the inc/elementz.php file, allowing remote attackers to add arbitrary user accounts. This is achieved by modifying the lilil parameter, in conjunction with the ubild and pa parameters.

Recommendations For aliTalk version 1.9.1.1, consider restricting access to the inc/elementz.php file until a proper fix is available, and avoid using the lilil, ubild, and pa parameters in a way that could facilitate unauthorized user account additions.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2008-0391

Affected Products

Alitalk

References · 3

• 🔥 https://exploit-db.com/exploits/4922 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-0391 · Security Note
• http://securityfocus.com/bid/27315 · Note