Unrated severityNVD Advisory· Published Jul 19, 2005· Updated Jun 16, 2026

CVE-2005-2314

Description

inc.login.php in PHPsFTPd 0.2 through 0.4 allows remote attackers to obtain the administrator's username and password by setting the do_login parameter and performing an edit action using user.php, which causes the login check to be bypassed and leaks the password in the response.

Affected products

Psftp/Phpsftpd2 versions
cpe:2.3:a:phpsftpd:phpsftpd:0.2:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:phpsftpd:phpsftpd:0.2:*:*:*:*:*:*:*
- cpe:2.3:a:phpsftpd:phpsftpd:0.4:*:*:*:*:*:*:*

Patches

Vulnerability mechanics

References

packetstorm.linuxsecurity.com/0507-exploits/phpsftpd.txtnvdExploitVendor Advisory
www.securityfocus.com/bid/14222nvdExploitPatch
secunia.com/advisories/15879nvdVendor Advisory
cert.uni-stuttgart.de/archive/bugtraq/2005/07/msg00209.htmlnvd
securitytracker.com/idnvd
www.vupen.com/english/advisories/2005/1101nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.002
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000