Unscored CVE-2003-0588 EUVD-2003-0582GHSA-644p-86mq-w7cq

admin.php in Digi-news 1.1 allows remote attackers to bypass authentication via a cookie with the username set to the name of the administr…

Published Oct 17, 2016 · Updated Aug 8, 2024 · Assigned by mitre

Description

admin.php in Digi-news 1.1 allows remote attackers to bypass authentication via a cookie with the username set to the name of the administrator, which satisfies an improper condition in admin.php that does not require a correct password.

References

20030716 Digi-news and Digi-ads version 1.1 admin access without password mailing-list