CVE-2009-1283

Glfusion < 1.1.2 - Cryptographic Issue

Title source: rule

Description

glFusion before 1.1.3 performs authentication with a user-provided password hash instead of a password, which allows remote attackers to gain privileges by obtaining the hash and using it in the glf_password cookie, aka "User Masquerading." NOTE: this can be leveraged with a separate SQL injection vulnerability to steal hashes.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Nine:Situations:Group · phpwebappsphp

https://www.exploit-db.com/exploits/8347

View Code ZIP pw:eip

References (6)

[Exploit] http://marc.info/?l=bugtraq&m=123877379105028&w=2

[Exploit] http://retrogod.altervista.org/9sg_glfuso_sql_cookies.html

[Vendor Advisory] http://secunia.com/advisories/34575

[Patch, Vendor Advisory] http://www.glfusion.org/article.php/glfusion113

[Vendor Advisory] http://www.glfusion.org/wiki/doku.php?id=glfusion:whatsnew

[Exploit, Third Party Advisory] https://www.exploit-db.com/exploits/8347

Scores

EPSS 0.0190

EPSS Percentile 83.3%

Details

CWE

CWE-310

Status published

Products (6)

glfusion/glfusion 1.0.0 (3 CPE variants)

glfusion/glfusion 1.0.1

glfusion/glfusion 1.0.2

glfusion/glfusion 1.1.0 (2 CPE variants)

glfusion/glfusion 1.1.1

glfusion/glfusion < 1.1.2

Published Apr 09, 2009

Tracked Since Feb 18, 2026