Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!

TUCoPS :: Web BBS :: etc :: bt611.txt

ASP-DEV Discussion Forum V2.0

ZH2003-4SA (security advisory): ASP-DEV Discussion Forum V2.0

Published: 12/07/2003

Released: 12/07/2003

Name: ASP-DEV Discussion Forum V2.0 

Affected Systems: All versions 

Issue: Remote attackers can obtain users information (including passwords)




Zone-h Security Team has discovered a serious security flaw in all 

versions of

ASP-DEV Discussion Forum "with many updated features, bug fixes and code 




ASP-DEV Discussion Forum V2.0 is an ASP forum system that covers all the 

needs for a forum. 

It's possible to retrieve sensible users information. There is an 


section for administrating this forum. This section is located here: (if forum is the installation dir of 

the forum)

By default this page isn't restricted, so everyone can be the 

administrator of this

forum. Everyone can see every password and every users information.



The vendor has been contacted and a patch is not yet produced



Protect the admin directory.

G00db0y - admin

Original advisory here:

TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2015 AOH