CVE-2008-2044 Auth bypass in n/a
Remote attackers can bypass authentication and execute arbitrary code by exploiting a flawed session variable comparison in netOffice Dwins.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2008-2044?
CVE-2008-2044 is a high-severity authentication bypass vulnerability in n/a, published on 1 May 2008. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
includes/library.php in netOffice Dwins 1.3 p2 compares the demoSession variable to the 'true' string literal instead of the true boolean literal, which allows remote attackers to bypass authentication and execute arbitrary code by setting this variable to 1, as demonstrated by uploading a PHP script via an add action to projects_site/uploadfile.php.
Weakness: CWE-94
Which versions are affected by CVE-2008-2044?
It affects 1 product.
Products include Netoffice Dwins.
How do I fix CVE-2008-2044?
No fix has been published for CVE-2008-2044 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2008-2044 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2008-2044 exists.
Public exploit code: 1 Exploit-DB entry.
Sources
Also known as GHSA-fp75-j58g-99xp.