Secunia Advisory: SA10442 Print Advisory
Release Date: 2003-12-16

Critical: Less critical
Impact: Exposure of sensitive information
Where: Local system

Software: CGIForum 1.x, CGINews 1.x


Description:
JeiAr has reported a weakness in CGINews and CGIForum, which can be exploited by malicious, local users to see passwords.

The problem is that the ".pwl" files are located in a directory, which by default is readable by anyone. Since the password is "encrypted" in a weak way, it can easily be decoded.

The issue has been reported to affect CGINews 1.07 and CGIForum 1.09.

Solution:
Edit the source code to ensure that passwords are stored using MD5.

Provided and/or discovered by:
JeiAr

Source: Secunia

OS/2-eCS-ArcaOS General News

More in General  

OS/2-eCS-ArcaOS Software News

More in Software  

Latest Forum Posts

Site News

More in Site News