Vulnerability Note VU#586720

JetboxOne leaves account database unencrypted

Overview

JetboxOne does not encrypt information in the account information database. Any user with the ability to query the database may be able to view confidential account information.

I. Description

JetboxOne is an open-source content management system that is written in PHP. An information disclosure vulnerability exists because JetboxOne does not encrypt account information stored in the admin (user) and webuser (standard user) tables of a MySQL database.

II. Impact

Any user with the ability to query the database may be able to view confidential account information. This may lead to unauthorized access to other accounts.

III. Solution

The CERT/CC is currently unaware of a practical solution to this problem.

Systems Affected

Vendor	Status	Date Notified	Date Updated
Streamedge Consultancy and Development	Vulnerable	13-Aug-2004

References

http://echo.or.id/adv/adv03-y3dips-2004.txt

Credit

This vulnerability was publicly reported by y3dips.

This document was written by Jeff Gennari.

Other Information

Date Public:	2004-08-04
Date First Published:	2004-08-13
Date Last Updated:	2004-08-13
CERT Advisory:
CVE-ID(s):
NVD-ID(s):
US-CERT Technical Alerts:
Severity Metric:	0.23
Document Revision:	37

If you have feedback, comments, or additional information about this vulnerability, please send us email.