PT-2010-1366 · Logoshows · Logoshows Bbs

Zorlu · Published 2010-01-04 · Updated 2017-09-19 · CVE-2009-4546

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Logoshows BBS version 2.0

Description The issue allows remote attackers to bypass authentication and gain administrative access. This is achieved by setting the pb username (also known as pb%5Fusername) and level cookies.

Recommendations For Logoshows BBS version 2.0, as a temporary workaround, consider restricting access to the globepersonnel login.asp page until a patch is available. Avoid using the pb username and level cookies in the affected login process until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2009-4546

Affected Products

Logoshows Bbs

References · 4

• 🔥 https://exploit-db.com/exploits/9400 · Exploit
• 🔥 http://exploit-db.com/exploits/9400 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-4546 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/52366 · Note