PT-2010-1481 · Roomphplanning · Roomphplanning

The G0Bl!N · Published 2010-03-05 · Updated 2017-09-19 · CVE-2009-4671

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions RoomPHPlanning version 1.6

Description The issue allows remote attackers to bypass authentication and obtain administrative access. This is achieved by setting the room phplanning cookie to a value associated with the admin account.

Recommendations For RoomPHPlanning version 1.6, consider temporarily restricting access to the Login.php file until a patch is available. As a workaround, avoid using the room phplanning cookie or restrict its use to minimize the risk of exploitation.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2009-4671

Affected Products

Roomphplanning

References · 4

• 🔥 https://exploit-db.com/exploits/8797 · Exploit
• 🔥 http://exploit-db.com/exploits/8797 · Exploit
• http://secunia.com/advisories/35237 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-4671 · Security Note