[Security-Bug]Missing ratelimiting at login panel can result in a brute force [Xoops Bug Reports]

XOOPS

Forum

Forum Index General Forums Community Support Modules Support Themes Support Development International Support Module Hack Reviews Theme Designer Talk

[Security-Bug]Missing ratelimiting at login panel can result in a brute force

2015/1/11 17:11
pbssubhash
Just popping in
Posts: 1
Since: 2015/1/11

Hey,
I found that there is missing rate-limiting protection at login panel of the Xoops CMS by using which an attacker can guess the passwords using brute force attacks.
I'd be more than happy to provide PoC's for this particular bug.

Thanks.

Re: [Security-Bug]Missing ratelimiting at login panel can result in a brute force

2015/1/11 17:19
Mamba
Moderator
Posts: 11412
Since: 2004/4/23

Thank you very much!

Please send me a Private Message with details.

Support XOOPS => DONATE
Use 2.5.11 | Docs | Modules | Bugs

Login

Username

Password

Remember me

Search

Advanced Search

Donat-O-Meter

Stats
Goal:	$100.00
Due Date:	Dec 31
Gross Amount:	$0.00
Net Balance:	$0.00
Left to go:	$100.00

Latest GitHub Commits

{{ record.sha.slice(0, 7) }} - {{ record.commit.message | truncate }}

{{ record.commit.author.name }} {{ record.commit.author.date | formatDate }}

[Security-Bug]Missing ratelimiting at login panel can result in a brute force

Re: [Security-Bug]Missing ratelimiting at login panel can result in a brute force

Login

Search

Recent Posts

Re: Help to import database

Re: xoops_redirect

Re: XOOPS MyMenus 1.54.0 Beta 10

Re: xoops_redirect

Vulnerability in xmnews, xmsocial and xmarticle modules

xoops_redirect

Re: XOOPS MyMenus 1.54.0 Beta 10

Re: XOOPS MyMenus 1.54.0 Beta 10

XOOPS MyMenus 1.54.0 Beta 10

Re: XOOPS MyMenus 1.54.0 Beta 7

Who's Online

Donat-O-Meter

Latest GitHub Commits

{{ record.sha.slice(0, 7) }} - {{ record.commit.message | truncate }}