Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2002-1820: Ultimate PHP Board allows attacker to masquerade as admin
CVE-2002-1820 · published 23 years ago
Summary
The registration page treats the built‑in administrator account "Admin" differently from a newly created account named "admin" (lower‑case). An outsider can sign up as "admin" and gain the same privileges as the real administrator. Update to a patched version or modify the code to make usernames case‑sensitive and rename the admin account.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| ultimate_php_board_project | ultimate_php_board |
1.0 cpe:2.3:a:ultimate_php_board_project:ultimate_php_board:1.0:-:*:*:*:*:*:* |
Original advisory text
register.php in Ultimate PHP Board (UPB) 1.0 and 1.0b uses an administrative account Admin with a capital "A," but allows a remote attacker to impersonate the administrator by registering an accoun...
register.php in Ultimate PHP Board (UPB) 1.0 and 1.0b uses an administrative account Admin with a capital "A," but allows a remote attacker to impersonate the administrator by registering an account name of admin with a lower case "a."
References
- http://www.iss.net/security_center/static/9972.php Broken Link Patch
- http://www.securityfocus.com/archive/1/289417 Broken Link Third Party Advisory VDB Entry
- http://www.securityfocus.com/bid/5580 Broken Link Third Party Advisory VDB Entry
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-178Improper Handling of Case Sensitivity
Timeline
Published31 Dec 2002
Updated29 Oct 2026
First seen29 Sep 2026
Sources
CVE-2002-1820 · NVD
Track software like this
Free during beta