CVE-2009-1283

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2009-04-09 · updated 2026-06-16
Weakness: CWE-310

Description

glFusion before 1.1.3 performs authentication with a user-provided password hash instead of a password, which allows remote attackers to gain privileges by obtaining the hash and using it in the glf_password cookie, aka "User Masquerading." NOTE: this can be leveraged with a separate SQL injection vulnerability to steal hashes.

Affected products

Glfusion: through 1.1.2; 1.0.0, 1.0.0-rc1, 1.0.0-rc2, 1.0.1, 1.0.2, 1.1.0 (+2)

References

http://marc.info/?l=bugtraq&m=123877379105028&w=2
http://retrogod.altervista.org/9sg_glfuso_sql_cookies.html
http://secunia.com/advisories/34575
http://www.glfusion.org/article.php/glfusion113
http://www.glfusion.org/wiki/doku.php?id=glfusion:whatsnew
https://www.exploit-db.com/exploits/8347
http://marc.info/?l=bugtraq&m=123877379105028&w=2
http://retrogod.altervista.org/9sg_glfuso_sql_cookies.html
http://secunia.com/advisories/34575
http://www.glfusion.org/article.php/glfusion113
http://www.glfusion.org/wiki/doku.php?id=glfusion:whatsnew
https://www.exploit-db.com/exploits/8347

Get alerted when CVE-2009-1283 or the next vulnerability affects your stack