CVE-2005-4448

FlatNuke 2.5.6 verifies authentication credentials based on an MD5 checksum of the admin name and the hashed password rather than the plaintext password, which allows attackers to gain privileges by obtaining the password hash (possibly via CVE-2005-2813), then calculating the credentials and including them in the secid cookie.

CVSS v2.0

10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS

2.82% chance of exploitation in the next 30 days, 86th percentile

Published

2005-12-21

Updated

2024-08-07

Proof-of-concept exploits (1)

• http://www.securityfocus.com/archive/1/419107

References

• CVE Record
• NVD entry

Related

• CVE-2005-4435
• CVE-2005-4449
• CVE-2005-4432
• CVE-2005-4454
• CVE-2005-4430
• CVE-2005-4456