CVE-2008-6537
LightNEasy 1.2 - Unauthenticated Administrator Password Hash Exposure via Setup Action
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2008-6537. PoCs published by girex.
AI-analyzed exploit summary This exploit retrieves the admin's SHA1 password hash from LightNEasy CMS 1.2 by bypassing authentication checks via a direct request to the setup page. It leverages a logic flaw where $_REQUEST['do'] is not properly sanitized, allowing unauthorized access to the hidden input field containing the hash.
Description
LightNEasy/lightneasy.php in LightNEasy No database version 1.2 allows remote attackers to obtain the hash of the administrator password via the setup "do" action to LightNEasy.php, which is cleared from $_GET but later accessed using $_REQUEST.
Exploits (1)
This exploit retrieves the admin's SHA1 password hash from LightNEasy CMS 1.2 by bypassing authentication checks via a direct request to the setup page. It leverages a logic flaw where $_REQUEST['do'] is not properly sanitized, allowing unauthorized access to the hidden input field containing the hash.