Detections
Analytics
CitrusDB Static id_hash Admin Authentication Bypass
high Nessus Plugin ID 16477
Language:
Synopsis
The remote host contains a PHP script that is affected by an authentication bypass vulnerability.Description
The remote host is running CitrusDB, an open source customer database application written in PHP.The version of CitrusDB installed on the remote host uses as an authentication cookie the MD5 checksum of a username followed by the constant 'boogaadeeboo'. Knowing a valid username on the remote install, an attacker may be able to leverage this issue to bypass authentication and gain access as that user. And in fact, Nessus has managed to exploit this issue to log in as the user 'admin', which is the default administrator name in CitrusDB.
Solution
Unknown at this time.See Also
Plugin Details
Severity: High
ID: 16477
File Name: citrusdb_password.nasl
Version: 1.19
Type: remote
Family: CGI abuses
Published: 2/16/2005
Updated: 1/19/2021
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 7.1
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
Vulnerability Information
CPE: cpe:/a:citrusdb:citrusdb
Required KB Items: www/PHP
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Available: true
Exploit Ease: No exploit is required
Vulnerability Publication Date: 2/13/2005
Reference Information
CVE: CVE-2005-0408