Description
setcookie.php for the administration login in Professional Home Page Tools Guestbook records the hash of the administrator password in a cookie, which allows attackers to conduct brute force password guessing attacks after obtaining the hash.
References
- http://artemis.abenteuer-mittelerde.de/pub/adv02-phptgb.txt
- 20060717 Professional PHP Tools Guestbook Multiple Vulnerabilities mailing-list
- phptguestbook-setcookie-insecure-cookie(27775) vdb-entry
- 21102 third-party-advisory
- 1016550 vdb-entry