{"vulnerability": "CVE-2021-26600", "sightings": [{"uuid": "189c29dd-5777-4431-857f-8de43f10b55c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26600", "type": "seen", "source": "https://t.me/cibsecurity/39624", "content": "\u203c CVE-2021-26600 \u203c\n\nImpressCMS before 1.4.3 has plugins/preloads/autologin.php type confusion with resultant Authentication Bypass (!= instead of !==).\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-03-28T07:39:51.000000Z"}, {"uuid": "48482cdd-5b9c-4f4c-b71c-d91bb244ca34", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26600", "type": "seen", "source": "https://t.me/hacking_Attack/47281", "content": "Exploit Collector\nImpressCMS 1.4.2 Authentication Bypass\n\nhttps://4.bp.blogspot.com/-42b-8Yu8ql4/WWlvfoDuyhI/AAAAAAAAIQE/GMGQD7Uo7DMncRccI_LNcWgfvYRkd0zwQCLcBGAs/s1600/h86.png \nImpressCMS versions 1.4.2 and below suffer from an authentication bypass vulnerability.\n\nMD5 | cb96afceb1d5f28665500ba31bf166ab\n\nDownload\n-----------------------------------------------------------------------\nImpressCMS <=\n-----------------------------------------------------------------------\n[-] Software Link:\n\nhttps://www.impresscms.org\n[-] Affected Versions:\n\nVersion 1.4.2 and prior versions.\n[-] Vulnerability Description:\n\nThe vulnerability is located in the /plugins/preloads/autologin.php script:\n\n45.            $uname = $myts->stripSlashesGPC($autologinName);\n46.            $pass = $myts->stripSlashesGPC($autologinPass);\n47.            if (empty($uname) || is_numeric($pass)) {\n48.                $user = false ;\n49.            } else {\n50.                // V3\n51.                $uname4sql = addslashes($uname);\n52.                $criteria = new icms_db_criteria_Compo(new \nicms_db_criteria_Item('login_name', $uname4sql));\n53.                $user_handler = icms::handler('icms_member_user');\n54.                $users = $user_handler->getObjects($criteria, false);\n55.                if (empty($users) || count($users) != 1) {\n56.                    $user = false ;\n57.                } else {\n58.                    // V3.1 begin\n59.                    $user = $users[0] ;\n60.                    $old_limit = time() - \n(defined('ICMS_AUTOLOGIN_LIFETIME') ? ICMS_AUTOLOGIN_LIFETIME : 604800);\n61.                    list($old_Ynj, $old_encpass) = explode(':', $pass);\n62.                    if (strtotime($old_Ynj) < $old_limit || \nmd5($user->getVar('pass') .\n63.                            ICMS_DB_PASS . ICMS_DB_PREFIX . $old_Ynj) \n!= $old_encpass)\n64.                    {\n65.                        $user = false;\n66.                    }\n\nUser input passed through the \"autologin_uname\" and \"autologin_pass\" \ncookie values is being used at lines 51-54 to fetch an user object from \nthe database, and then at lines 62-63 to check the correctness of the \nuser's password. The vulnerability exists because of an unsafe way of \ncomparing those parameters, due to comparison operator != is being used \ninstead of !== within the \"if\" statement at lines 62-63. The latter \noperator returns \"true\" only if the compared values are equal and the \nsame type, while the first compares the values after \"type juggling\". \nThis might be exploited to potentially bypass the authentication \nmechanism and login as any user without the knowledge of the password.\n[-] Solution:\n\nUpgrade to version 1.4.3 or later.\n[-] Disclosure Timeline:\n\n[20/01/2021] - Vendor notified through HackerOne\n[02/02/2021] - Vendor replied this has been resolved and will be in \nImpressCMS 1.4.3\n[03/02/2021] - CVE number assigned\n[06/02/2022] - Version 1.4.3 released\n[22/03/2022] - Public disclosure\n[-] CVE Reference:\n\nThe Common Vulnerabilities and Exposures project (cve.mitre.org)\nhas assigned the name CVE-2021-26600 to this vulnerability.\n[-] Credits:\n\nVulnerability discovered by Egidio Romano.\n[-] Other References:\n\nhttps://hackerone.com/reports/1081986\n[-] Original Advisory:\n\nhttp://karmainsecurity.com/KIS-2022-01\n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-01T20:01:50.678478Z"}, {"uuid": "632f4549-4f7b-4c72-b689-999c1efad079", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26600", "type": "seen", "source": "https://t.me/hacking_Attack/47281", "content": "Exploit Collector\nImpressCMS 1.4.2 Authentication Bypass\n\nhttps://4.bp.blogspot.com/-42b-8Yu8ql4/WWlvfoDuyhI/AAAAAAAAIQE/GMGQD7Uo7DMncRccI_LNcWgfvYRkd0zwQCLcBGAs/s1600/h86.png \nImpressCMS versions 1.4.2 and below suffer from an authentication bypass vulnerability.\n\nMD5 | cb96afceb1d5f28665500ba31bf166ab\n\nDownload\n-----------------------------------------------------------------------\nImpressCMS <=\n-----------------------------------------------------------------------\n[-] Software Link:\n\nhttps://www.impresscms.org\n[-] Affected Versions:\n\nVersion 1.4.2 and prior versions.\n[-] Vulnerability Description:\n\nThe vulnerability is located in the /plugins/preloads/autologin.php script:\n\n45.            $uname = $myts->stripSlashesGPC($autologinName);\n46.            $pass = $myts->stripSlashesGPC($autologinPass);\n47.            if (empty($uname) || is_numeric($pass)) {\n48.                $user = false ;\n49.            } else {\n50.                // V3\n51.                $uname4sql = addslashes($uname);\n52.                $criteria = new icms_db_criteria_Compo(new \nicms_db_criteria_Item('login_name', $uname4sql));\n53.                $user_handler = icms::handler('icms_member_user');\n54.                $users = $user_handler->getObjects($criteria, false);\n55.                if (empty($users) || count($users) != 1) {\n56.                    $user = false ;\n57.                } else {\n58.                    // V3.1 begin\n59.                    $user = $users[0] ;\n60.                    $old_limit = time() - \n(defined('ICMS_AUTOLOGIN_LIFETIME') ? ICMS_AUTOLOGIN_LIFETIME : 604800);\n61.                    list($old_Ynj, $old_encpass) = explode(':', $pass);\n62.                    if (strtotime($old_Ynj) < $old_limit || \nmd5($user->getVar('pass') .\n63.                            ICMS_DB_PASS . ICMS_DB_PREFIX . $old_Ynj) \n!= $old_encpass)\n64.                    {\n65.                        $user = false;\n66.                    }\n\nUser input passed through the \"autologin_uname\" and \"autologin_pass\" \ncookie values is being used at lines 51-54 to fetch an user object from \nthe database, and then at lines 62-63 to check the correctness of the \nuser's password. The vulnerability exists because of an unsafe way of \ncomparing those parameters, due to comparison operator != is being used \ninstead of !== within the \"if\" statement at lines 62-63. The latter \noperator returns \"true\" only if the compared values are equal and the \nsame type, while the first compares the values after \"type juggling\". \nThis might be exploited to potentially bypass the authentication \nmechanism and login as any user without the knowledge of the password.\n[-] Solution:\n\nUpgrade to version 1.4.3 or later.\n[-] Disclosure Timeline:\n\n[20/01/2021] - Vendor notified through HackerOne\n[02/02/2021] - Vendor replied this has been resolved and will be in \nImpressCMS 1.4.3\n[03/02/2021] - CVE number assigned\n[06/02/2022] - Version 1.4.3 released\n[22/03/2022] - Public disclosure\n[-] CVE Reference:\n\nThe Common Vulnerabilities and Exposures project (cve.mitre.org)\nhas assigned the name CVE-2021-26600 to this vulnerability.\n[-] Credits:\n\nVulnerability discovered by Egidio Romano.\n[-] Other References:\n\nhttps://hackerone.com/reports/1081986\n[-] Original Advisory:\n\nhttp://karmainsecurity.com/KIS-2022-01\n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-02T01:02:03.433835Z"}]}