Description
backup.php in HandsomeWeb SOS Webpages before 1.1.12 does not require knowledge of the cleartext password, which allows remote attackers to bypass authentication by leveraging knowledge of the administrator password hash.
Metrics
CVSS 3.1 9.8/10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
References
- http://packetstormsecurity.com/files/126844/HandsomeWeb-SOS-Webpages-1.1.11-Backup-Hash-Disclosure.htmlExploit, Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2014/May/130Exploit, Mailing List, Third Party Advisory
- http://sourceforge.net/projects/soswebpages/files/SOS%20Webpages/SOS%20Webpages%201.1.12/Third Party Advisory
- http://www.securityfocus.com/bid/67644Third Party Advisory, VDB Entry
- https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-3445/Exploit, Third Party Advisory
- http://packetstormsecurity.com/files/126844/HandsomeWeb-SOS-Webpages-1.1.11-Backup-Hash-Disclosure.htmlExploit, Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2014/May/130Exploit, Mailing List, Third Party Advisory
- http://sourceforge.net/projects/soswebpages/files/SOS%20Webpages/SOS%20Webpages%201.1.12/Third Party Advisory
- http://www.securityfocus.com/bid/67644Third Party Advisory, VDB Entry
- https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-3445/Exploit, Third Party Advisory
Timeline
- Published
- Jan 28, 2020
- Last modified
- Jun 17, 2026
- NVD status
- Modified