Skip to content
Fencer Vulns
high 7.5

CVE-2008-7050 json

The password_check function in auth/auth_phpbb3.php in WoW Raid Manager 3.5.1 before Patch 1, when using PHPBB3 authentication, (1) does no…

published 2009-08-24 17 y ago modified 2026-06-16 4 mo ago also EUVD-2008-7009

cvss
7.5
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.9%
EPSS 1.9% chance of exploitation in 30 days, percentile 79%
public exploits
0
none known

Summary

The password_check function in auth/auth_phpbb3.php in WoW Raid Manager 3.5.1 before Patch 1, when using PHPBB3 authentication, (1) does not invoke the CheckPassword function with the required arguments, which always triggers an authentication failure, and (2) returns true instead of false when an authentication failure occurs, which allows remote attackers to bypass authentication and gain privileges with an arbitrary password.

Patch / fix

Exploit prediction

1.88% chance of exploitation in the next 30 days, higher than 79% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com http://github.com/Illydth/wowraidmanager/commit/7dd6367ae85003dd5d715431b6ab695f2c2f200a referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P

Classification

Weakness
  • CWE-255 Credentials Management Errors

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.