CVE-2021-26600

ImpressCMS before 1.4.3 has plugins/preloads/autologin.php type confusion with resultant Authentication Bypass != instead of !==...

CVE-2021-26600

ImpressCMS contains a type confusion in plugins/preloads/autologin.php that leads to Authentication Bypass for versions prior to 1.4.3. The vulnerability is evidenced by multiple sources (GHSA/OSV/NVD entries) describing an authentication bypass via the autologin path, with affected versions list...

ImpressCMS 1.4.2 Authentication Bypass Vulnerability

----------------------------------------------------------------------- ImpressCMS stripSlashesGPC$autologinName; 46. $pass = $myts-stripSlashesGPC$autologinPass; 47. if empty$uname || isnumeric$pass 48. $user = false ; 49. else 50. // V3 51. $uname4sql = addslashes$uname; 52. $criteria = new...

ImpressCMS 1.4.2 Authentication Bypass

----------------------------------------------------------------------- ImpressCMS stripSlashesGPC$autologinName; 46. $pass = $myts-stripSlashesGPC$autologinPass; 47. if empty$uname || isnumeric$pass 48. $user = false ; 49. else 50. // V3 51. $uname4sql = addslashes$uname; 52. $criteria = new...