| शीर्षक | HuangDou UTCMS V9 login function verification code bypasses vulnerability |
|---|
| विवरण | The background login page of UTCMS V9 (app/modules/ut-frame/admin/login.php) has a logical flaw in verifying the verification code submitted by the user. Due to the loose == comparison operator used, and in some cases $_SESSION['authcode'] may be null, an attacker can bypass verification by submitting an empty verification code. "" == null is judged to be true in PHP, which completely invalidates the verification code mechanism. This allows attackers to perform dictionary attacks or brute force cracking on backend user accounts without restrictions. |
|---|
| स्रोत | ⚠️ https://github.com/August829/Yu/blob/main/20250811_2.md |
|---|
| उपयोगकर्ता | Yu Bao (UID 88956) |
|---|
| सबमिशन | 12/08/2025 03:47 PM (11 महीनों पहले) |
|---|
| संयम | 24/08/2025 04:52 PM (12 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 321237 [HuangDou UTCMS 9 Login login.php code अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|