PT-2020-19936 · Usebb Team · Usebb

Xavi · Published 2020-01-27 · Updated 2021-07-21 · CVE-2020-8088

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions UseBB version 1.0.12

Description The issue allows for a login bypass due to type juggling in the panel login.php file. This occurs because the != operator is used instead of !== for password hashes, leading to mishandling of hashes that begin with 0e followed by exclusively numerical characters.

Recommendations For UseBB version 1.0.12, consider modifying the panel login.php file to use the !== operator instead of != for password hash comparisons to prevent type juggling attacks. As a temporary workaround, restrict access to the login functionality until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2020-8088

Affected Products

Usebb

References · 4

• 🔥 https://xavibel.com/2020/01/22/usebb-forum-php-type-juggling-vulnerability · Exploit
• https://osv.dev/vulnerability/CVE-2020-8088 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-8088 · Security Note
• https://t.me/cvenotify/485 · Telegram Post