Info

Disclosure

Sep 03, 2006

Discovery

Unknown

Dates

Exploit

Sep 03, 2006

Solution

Unknown

Description

Tr Forum contains a flaw that may allow a malicious user to bypass certain security restrictions. The issue is triggered due to missing authentication verification in admin/insert_admin.php. It is possible that the flaw may allow creating an administrator account with limited privileges resulting in a loss of integrity.

Classification

Location: Remote / Network Access
Attack Type: Input Manipulation
Impact: Loss of Integrity
Exploit: Exploit Public
OSVDB: Web Related

Solution

Currently, there are no known upgrades, patches, or workarounds available to correct this issue.

Products

ComScripts.com

Tr Forum

2.0

References

Exploit Database: 12385 2297
Bugtraq ID: 19834
CVE ID: 2006-4584 (see also: NVD)
Secunia Advisory ID: 21754
Milw0rm: 2297
Related OSVDB ID: 28542 28543 28545
VUPEN Advisory: ADV-2006-3452
Other Advisory URL: http://acid-root.new.fr/poc/10060903.txt
Mail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-09/0017.html
Vendor URL: http://www.comscripts.com/scripts/php.tr-forum.1579.html

Credit

DarkFig - gmdarkfiggmail.com -

Direct URL: http://osvdb.org/28544