Description
ifdate 2.x sends a redirect to the web browser but does not exit when administrative credentials are missing, which allows remote attackers to obtain administrative access via a direct request for the admin/ URI.
References
- 23971 vdb-entry
- 20070513 ifdate 2.* unauthorized administrative access bug mailing-list
- 36173 vdb-entry
- 25237 third-party-advisory
- ifdate2-admin-auth-bypass(34257) vdb-entry
- 2707 third-party-advisory
- http://www.expw0rm.com/ifdate-2-unauthorized-administrative-access-bug_no285.html