CVE-2002-0286

The GetPassword function in function.php of SiteNews 0.10 and 0.11 allows remote attackers to gain privileges and add users by providing a non-existent user name and the MD5 checksum for an empty password to add_user.php, which causes GetPassword to produce and compare a blank password for the non-existent user.

CVSS v2.0

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

1.57% chance of exploitation in the next 30 days, 74th percentile

Published

2002-05-03

Updated

2024-08-08

Proof-of-concept exploits (1)

• http://marc.info/?l=bugtraq&m=101388393808699&w=2

References

• CVE Record
• NVD entry

Related

• CVE-2002-0280
• CVE-2002-0288
• CVE-2002-0276
• CVE-2002-0289
• CVE-2002-0266
• CVE-2002-0296