Description
Vvveb before 1.0.9.0 contains an authentication bypass vulnerability in generateCookie() in system/user/user.php that uses loose comparison to validate MD5 cookie hashes. Unauthenticated attackers can brute-force cookie values until the server's MD5 computation yields a 0e magic hash, then forge persistent cookies for account takeover.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| givanz | Vvveb | 0 <1.0.9.0 | — |