CVE-2020-37156

Summary

BloodX 1.0 contains an authentication bypass vulnerability in login.php that allows attackers to access the dashboard without valid credentials. Attackers can exploit the vulnerability by sending a crafted payload with '=''or' parameters to bypass login authentication and gain unauthorized access.

Affected Software

Weaknesses

• CWE-288: Authentication Bypass Using an Alternate Path or Channel

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: partial

References

• https://www.exploit-db.com/exploits/47842
• https://github.com/diveshlunker/BloodX
• https://www.vulncheck.com/advisories/bloodx-authentication-bypass

• ←Previous
• Next→