eFront <= 3.6.10 Authentication Bypass / Privilege Escalation Vulnerability


eFront contains a flaw related to the index.php script which fails to properly sanitize user-supplied input passed via the ‘cookie_login’ cookie parameter before use it to instanciate a new user object. This can be exploited to bypass the authentication mechanism and to escalate privilege.


Disclosure Date:

October 27, 2011