PT-2008-5994 · Aflog · Aflog

Joss · Published 2008-10-29 · Updated 2017-09-29 · CVE-2008-4784

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions aflog version 1.01

Description The issue allows remote attackers to bypass authentication and gain administrative access. This can be achieved by setting the aflog auth a cookie to "A" or "O" in several API endpoints, including "edit delete.php", "edit cat.php", "edit lock.php", and "edit form.php".

Recommendations For aflog version 1.01, as a temporary workaround, consider restricting access to the "edit delete.php", "edit cat.php", "edit lock.php", and "edit form.php" endpoints until a patch is available. Avoid using the aflog auth a cookie or restrict its value to prevent unauthorized access.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2008-4784

Affected Products

Aflog

References · 5

• 🔥 https://exploit-db.com/exploits/6818 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-4784 · Security Note
• http://securityreason.com/securityalert/4524 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46083 · Note
• http://securityfocus.com/bid/31894 · Note