Detections
Analytics
CVE-2005-4448
critical
Description
FlatNuke 2.5.6 verifies authentication credentials based on an MD5 checksum of the admin name and the hashed password rather than the plaintext password, which allows attackers to gain privileges by obtaining the password hash (possibly via CVE-2005-2813), then calculating the credentials and including them in the secid cookie.
References
https://exchange.xforce.ibmcloud.com/vulnerabilities/22159
https://euvd.enisa.europa.eu/vulnerability/EUVD-2005-4443
http://www.securityfocus.com/bid/15796
http://www.securityfocus.com/archive/1/419107
http://securitytracker.com/id?1015339
http://cvs.sourceforge.net/viewcvs.py/flatnuke/flatnuke/Changelog?rev=1.78&view=markup