PT-2009-2519 · Blizzard+1 · Wow Raid Manager+1

Published 2009-08-24 · Updated 2009-08-24 · CVE-2008-7050

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions WoW Raid Manager version 3.5.1

Description The issue concerns the password check function in the auth/auth phpbb3.php file when using PHPBB3 authentication. It has two main problems: (1) it does not correctly invoke the CheckPassword function with the necessary arguments, leading to authentication failures, and (2) it returns true instead of false when an authentication failure occurs. This allows remote attackers to bypass authentication with any password, potentially gaining privileges.

Recommendations For WoW Raid Manager version 3.5.1, apply Patch 1 to fix the authentication bypass issue in the password check function.

Exploit

Fix

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2008-7050

Affected Products

Phpbb3

Wow Raid Manager

References · 8

• 🔥 http://github.com/Illydth/wowraidmanager/commit/7dd6367ae85003dd5d715431b6ab695f2c2f200a · Exploit
• http://secunia.com/advisories/32653 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-7050 · Security Note
• http://wowraidmanager.net/e107_plugins/forum/forum_viewtopic.php?2167 · Vendor Advisory
• http://vupen.com/english/advisories/2008/3109 · Vendor Advisory
• http://wowraidmanager.net/e107_plugins/forum/forum_viewtopic.php?2153 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-7050 · Note
• http://osvdb.org/49704 · Note