CVE-2004-1567

Vulnerability

Silent Storm Portal versions 2.1 and 2.2 contain a privilege escalation vulnerability in profile.php. The script insufficiently sanitizes user-supplied data, allowing an attacker to inject escape character sequences into the users.dat file. By setting the mail parameter to 1 (the administrator level value), a remote attacker can escalate their privileges to administrator. [1]

Exploitation

An attacker can send a crafted HTTP request to profile.php with the mail parameter set to 1. No authentication is required; the attacker can be remote. The request injects the administrator level into the users.dat file, effectively granting admin privileges to the attacker's account. [1]

Impact

Successful exploitation allows the attacker to gain full administrative access to the Silent Storm Portal. This leads to complete compromise of the portal, including the ability to modify content, access user data, and perform any administrative actions. [1]

Mitigation

The vendor has not released a patch; the software appears to be end-of-life. As a workaround, restrict access to profile.php or remove the vulnerable portal. No fix is known. [1]