Description
pm.php (aka the PM system) in DeluxeBB 1.08, and possibly earlier, allows remote attackers to bypass authentication by providing an arbitrary username in the membercookie cookie parameter.
References
- deluxebb-membercookie-security-bypass(28270) vdb-entry
- 27834 vdb-entry
- 1381 third-party-advisory
- 20060807 DeluxeBB Multiple Vulnerabilities mailing-list
- ADV-2006-3188 vdb-entry
- 21387 third-party-advisory
- 19418 vdb-entry