Required CVE Record Information
Description
auth.php in openInvoice 0.90 beta and earlier allows remote attackers to bypass authentication and gain privileges by setting the oiauth cookie. NOTE: this can be leveraged with a separate vulnerability in resetpass.php to modify passwords for arbitrary users.
References 3 Total
Updated:
This container includes required additional information provided by the CVE Program for this vulnerability.
References 3 Total
- exploit-db.com: 5466 exploitx_transferred
- exchange.xforce.ibmcloud.com: openinvoice-cookie-security-bypass(41947) vdb-entryx_transferred
- securityfocus.com: 28854 vdb-entryx_transferred