Title: 427BB Authentication Bypass Vulnerability
Severity: HIGH
Description:
427BB is a bulletin board system implemented in PHP utilizing a MySQL backend.
427BB is prone to an authentication bypass vulnerability. This issue is due to a failure in the application to properly validate user-supplied cookie data.
The problem presents itself with how the application verifies user-credentials in the 'login.php' and 'getvar.php' scripts. The application uses cookie-data to authenticate users, but does not check the validity of the password. An attacker can supply the 'username', 'usertype' and 'authenticated==1' cookie parameters of an arbitrary user and gain access as that user.
An attacker can exploit this issue to bypass the authentication mechanism and gain access to the affected application as an administrative user. This may facilitate a compromise of the underlying system; other attacks are also possible.
This issue affects version 2.2 and 2.2.1; other versions may also be vulnerable.
Affected Products:
- 427BB fourtwosevenbb 2.2.0
- 427BB fourtwosevenbb 2.2.1
References:
- 427BB: 427BB Homepage
- eVuln: 427BB Multiple Vulnerabilities (Cookie-based Authentication Bypass, SQL Injectio
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
