CVE-2002-0491 - admin.php in AlGuest 1.0 guestbook checks for the existence of the admin cookie to authenticate the

CVE-2002-0491

Summary

admin.php in AlGuest 1.0 guestbook checks for the existence of the admin cookie to authenticate the AlGuest administrator, which allows remote attackers to bypass the authentication and gain privileges by setting the admin cookie to an arbitrary value.

References

http://www.iss.net/security_center/static/8623.php
http://www.securityfocus.com/archive/1/263902
http://www.securityfocus.com/bid/4355

Vulnerable Configurations

cpe:2.3:a:alguest:alguest:1.0:*:*:*:*:*:*:*
cpe:2.3:a:alguest:alguest:1.0:*:*:*:*:*:*:*

CVSS

Base:	10.0 (as of 05-09-2008 - 20:28)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
COMPLETE	COMPLETE	COMPLETE

cvss-vector via4

AV:N/AC:L/Au:N/C:C/I:C/A:C

refmap via4

bid	4355
bugtraq	20020324 Cookie vulnerability in Alguest guestbook (PHP)
xf	alguest-php-admin-access(8623)

Last major update

05-09-2008 - 20:28

Published

12-08-2002 - 04:00

Last modified

05-09-2008 - 20:28