Unrated severityNVD Advisory· Published Apr 9, 2009· Updated Jun 16, 2026
CVE-2009-1283
CVE-2009-1283
Description
glFusion before 1.1.3 performs authentication with a user-provided password hash instead of a password, which allows remote attackers to gain privileges by obtaining the hash and using it in the glf_password cookie, aka "User Masquerading." NOTE: this can be leveraged with a separate SQL injection vulnerability to steal hashes.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
10cpe:2.3:a:glfusion:glfusion:*:*:*:*:*:*:*:*+ 9 more
- cpe:2.3:a:glfusion:glfusion:*:*:*:*:*:*:*:*range: <=1.1.2
- cpe:2.3:a:glfusion:glfusion:1.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:glfusion:glfusion:1.0.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:glfusion:glfusion:1.0.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:glfusion:glfusion:1.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:glfusion:glfusion:1.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:glfusion:glfusion:1.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:glfusion:glfusion:1.1.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:glfusion:glfusion:1.1.1:*:*:*:*:*:*:*
- (no CPE)range: <1.1.3
Patches
Vulnerability mechanics
References
6- www.glfusion.org/article.php/glfusion113nvdPatchVendor Advisory
- marc.infonvdExploit
- retrogod.altervista.org/9sg_glfuso_sql_cookies.htmlnvdExploit
- secunia.com/advisories/34575nvdVendor Advisory
- www.glfusion.org/wiki/doku.phpnvdVendor Advisory
- www.exploit-db.com/exploits/8347nvd
News mentions
0No linked articles in our index yet.