full-disclosure - WebCalendar User Account Enumeration Weakness

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Thu May  4 23:10:37 2006
From: david.maciejak at gmail.com (David Maciejak)
Subject: WebCalendar User Account Enumeration Weakness

WebCalendar is a PHP-based calendar application that can be configured
as a single-user calendar, a multi-user calendar for groups of users,
or as an event calendar viewable by visitors.
See project homepage for details: http://www.k5n.us/webcalendar.php

Description:

The problem is that different error messages are returned depending
on whether an unsuccessful login attempt is performed with a valid or
invalid username in the login page.

Error message extract from 'includes/user.php' can be
"Invalid login"
"Invalid login: incorrect password"
"Invalid login: no such user"

The weakness has been confirmed in version 1.0.1, 1.0.2, 1.0.3.
Other versions may also be affected.

David Maciejak