CVE-2005-3005 Helpdesk Software Hesk allows remote attackers to bypass authentication for (1) admin.php and (2) admin_main.php by modifying the PHPSESSID session ID parameter or cookie.
HighCVSS 7.5
EPSS 3.0%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Helpdesk Software Hesk allows remote attackers to bypass authentication for (1) admin.php and (2) admin_main.php by modifying the PHPSESSID session ID parameter or cookie.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| helpdesk software hesk | = 0.92 | No fix listed |
| helpdesk software hesk | = 0.93 | No fix listed |
References
- 20050920 Hesk Session ID Validation Vulnerability mailing-list
- 16859 patch third-party-advisory vendor-advisory
- www.phpjunkyard.com patch
- 14879 exploit patch vdb-entry
- ADV-2005-1792 vdb-entry