| tiêu đề | PEShop PEShop <=1.0 Auth-Bypass |
|---|
| Mô tả | The PEShop software, version 1.0 and earlier, is vulnerable to an authentication bypass exploit due to insecure implementation of encryption and decryption logic in the decode and encode functions in the strings class. This flaw allows an attacker to externally calculate and restore the key used for encrypting and decrypting session data. Consequently, an attacker can forge serialized data, carry out SQL injections, modify administrator passwords, and forge administrator sessions, thereby gaining unauthorized access to the system. |
|---|
| Nguồn | ⚠️ https://note.zhaoj.in/share/qrnusO94AnZF |
|---|
| Người dùng | glzjin (UID 59815) |
|---|
| Đệ trình | 06/02/2024 03:52 (cách đây 3 những năm) |
|---|
| Kiểm duyệt | 06/02/2024 09:45 (6 hours later) |
|---|
| Trạng thái | Bản sao |
|---|
| Mục VulDB | 247357 [PHPEMS 6.x/7.x/8.x/9.0 Session Data lib/session.cls.php nâng cao đặc quyền] |
|---|
| điểm | 0 |
|---|