CVEvulnerability
CVE-2005-4448
10.0 HIGH
Official page ↗
- Status
- Modified
- Published
- 2005-12-21
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
Description
FlatNuke 2.5.6 verifies authentication credentials based on an MD5 checksum of the admin name and the hashed password rather than the plaintext password, which allows attackers to gain privileges by obtaining the password hash (possibly via CVE-2005-2813), then calculating the credentials and including them in the secid cookie.
Affected configurations
• flatnuke flatnuke 2.5.6
References
- http://cvs.sourceforge.net/viewcvs.py/flatnuke/flatnuke/Changelog?rev=1.78&view=markup cvs.sourceforge.net
- http://securitytracker.com/id?1015339 Exploit
- http://www.securityfocus.com/archive/1/419107 Exploit
- http://www.securityfocus.com/bid/15796 Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/22159 exchange.xforce.ibmcloud.com
- http://cvs.sourceforge.net/viewcvs.py/flatnuke/flatnuke/Changelog?rev=1.78&view=markup cvs.sourceforge.net
- http://securitytracker.com/id?1015339 Exploit
- http://www.securityfocus.com/archive/1/419107 Exploit
- http://www.securityfocus.com/bid/15796 Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/22159 exchange.xforce.ibmcloud.com