Vulnerability Note VU#140723

Advanced Poll does not adequately authenticate users

Overview

Advanced Poll is a polling system written in PHP for use on web sites. When a flat file database is used, Advanced Poll does not adequately authenticate users, thereby allowing any user to gain Advanced Poll administrative privileges.

I. Description

On versions of Advanced Poll older than 1.61 configured to use a flat file database, Advanced Poll allows clients to login as any user by setting the "logged_in" variable in the CGI query string of the GET request to Advanced Poll.

II. Impact

Attackers may login as the administrative user without authentication and gain adminstrator privileges for Advanced Poll.

III. Solution

Upgrade to version 1.61 or later at:

http://www.proxy2.de
None.

Systems Affected

Vendor	Status	Date Updated
Chi Kien Uong	Unknown	20-Dec-2001

References

http://securitytracker.com/alerts/2001/Oct/1002516.html
http://www.proxy2.de

Credit

Thanks to Derek Comartin and Security Tracker for reporting this vulnerability.

This document was written by a member of the technical staff.

Other Information

Date Public	10/10/2001
Date First Published	12/20/2001 11:31:07 AM
Date Last Updated	12/21/2001
CERT Advisory
CVE Name
Metric	1.14
Document Revision	10

If you have feedback, comments, or additional information about this vulnerability, please send us email.