Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
The cookie authentication method in WordPress 2.5 relies on a hash of a concatenated string containing USERNAME and EXPIRY_TIME, which allows remote attackers to forge cookies by registering a username that results in the same concatenated string, as demonstrated by registering usernames beginning with "admin" to obtain administrator privileges, aka a "cryptographic splicing" issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2007-6013.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
WordPress Cookie完整性保护非授权访问漏洞
Vulnerability Description
WordPress是一款免费的论坛Blog系统。 从2.5版本开始Wordpress使用加密保护的cookie认证登录用户。新的cookie形式为： "wordpress_".COOKIEHASH = USERNAME . "|" . EXPIRY_TIME . "|" . MAC MAC是由USERNAME和EXPIRY_TIME所生成的密钥计算得出的。由于USERNAME和EXPIRY_TIME在MAC计算中没有分隔开，因此如果USERNAME和EXPIRY_TIME连接后没有变化的话，攻击者就可以未
CVSS Information
N/A
Vulnerability Type
N/A