CVE-2005-0408

CriticalCVSS 9.8/10Last modified Jun 16, 2026

Description

CitrusDB 0.3.6 and earlier generates easily predictable MD5 hashes of the user name for the id_hash cookie, which allows remote attackers to bypass authentication and gain privileges by calculating the MD5 checksum of the user name combined with the "boogaadeeboo" string, which is hard-coded in the $hidden_hash variable.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-916

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.grok.org.uk/pipermail/full-disclosure/2005-February/031707.htmlBroken Link
http://www.redteam-pentesting.de/advisories/rt-sa-2005-002.txtExploit, Vendor Advisory
http://lists.grok.org.uk/pipermail/full-disclosure/2005-February/031707.htmlBroken Link
http://www.redteam-pentesting.de/advisories/rt-sa-2005-002.txtExploit, Vendor Advisory

Timeline

Published: Feb 14, 2005
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2005

CVE-2005-04096.4CitrusDB 0.3.6 and earlier does not verify authorization for the (1) importcc.php and (2) uploadcc.php, which allows remote attackers to upl CVE-2005-04105.0SQL injection vulnerability in importcc.php for CitrusDB 0.3.6 and earlier allows remote attackers to inject data via the fields of a CSV fi CVE-2005-04117.5Directory traversal vulnerability in index.php for CitrusDB 0.3.6 and earlier allows remote attackers and local users to include arbitrary P CVE-2005-04126.8Cross-site scripting (XSS) vulnerability in Spidean PostWrap allows remote attackers to inject arbitrary HTML and web script via the page pa CVE-2005-04137.5Multiple SQL injection vulnerabilities in MyPHP Forum 1.0 allow remote attackers to execute arbitrary SQL commands via (1) the fid in forum.CVE-2005-04147.5SQL injection vulnerability in post.php for MercuryBoard 1.1.1 allows remote attackers to execute arbitrary SQL commands via a reply post ac CVE-2005-04155.0Multiple memory leaks in the MQL parser in Emdros before 1.1.22 allow remote attackers to cause a denial of service (memory consumption) via CVE-2005-04167.5The Windows Animated Cursor (ANI) capability in Windows NT, Windows 2000 through SP4, Windows XP through SP1, and Windows 2003 allows remote CVE-2005-041710.0Unknown "high risk" vulnerability in DB2 Universal Database 8.1 and earlier has unknown impact and attack vectors. NOTE: due to the delayed CVE-2005-04187.5Argument injection vulnerability in Java Web Start for J2SE 1.4.2 up to 1.4.2_06, on Mac OS X, allows untrusted applications to gain privile CVE-2005-04197.5Multiple heap-based buffer overflows in 3Com 3CServer allow remote authenticated users to execute arbitrary code via long FTP commands, as d CVE-2005-04205.8Microsoft Outlook Web Access (OWA), when used with Exchange, allows remote attackers to redirect users to arbitrary URLs for login via a lin