Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!


TUCoPS :: Web :: Apps :: b06-2023.htm

WebCalendar User Account Enumeration Weakness



WebCalendar User Account Enumeration Weakness
WebCalendar User Account Enumeration Weakness



WebCalendar is a PHP-based calendar application that can be configured
as a single-user calendar, a multi-user calendar for groups of users,
or as an event calendar viewable by visitors.
See project homepage for details: http://www.k5n.us/webcalendar.php 

Description:

The problem is that different error messages are returned depending
on whether an unsuccessful login attempt is performed with a valid or
invalid username in the login page.

Error message extract from 'includes/user.php' can be
"Invalid login"
"Invalid login: incorrect password"
"Invalid login: no such user"

The weakness has been confirmed in version 1.0.1, 1.0.2, 1.0.3.
Other versions may also be affected.


David Maciejak


TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH