Description
common.inc.php in phpWebLog 0.4.2 does not properly initialize the $CONF array, which inadvertently sets the password to a single character, allowing remote attackers to easily guess the SiteKey and gain administrative privileges to phpWebLog.
References
- phpweblog-bypass-authentication(5625) vdb-entry
- 2047 vdb-entry
- 20001202 Bypassing admin authentication in phpWebLog mailing-list