Published: 03/08/2005 Updated: 10/09/2017

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

VMScore: 510

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

Lotus Domino R5 and R6 WebMail, with "Generate HTML for all fields" enabled, stores sensitive data from names.nsf in hidden form fields, which allows remote malicious users to read the HTML source to obtain sensitive information such as (1) the password hash in the HTTPPassword field, (2) the password change date in the HTTPPasswordChangeDate field, (3) the client platform in the ClntPltfrm field, (4) the client machine name in the ClntMachine field, and (5) the client Lotus Domino release in the ClntBld field, a different vulnerability than CVE-2005-2696.

Vulnerable Product	Search on Vulmon	Subscribe to Product
ibm lotus domino 5.0
ibm lotus domino 6.0
ibm lotus domino 6.5

Lotus Domino versions R6 and below Webmail remote password hash dumper exploit ...

#!/bin/bash # # $Id: raptor_dominohash,v 13 2007/02/13 17:27:28 raptor Exp $ # # raptor_dominohash - Lotus Domino R5/R6 HTTPPassword dump # Copyright (c) 2007 Marco Ivaldi <raptor@0xdeadbeefinfo> # # Lotus Domino R5 and R6 WebMail, with "Generate HTML for all fields" enabled, # stores sensitive data from namesnsf in hidden form fields, w ...

# Exploit Title: IBM Lotus Domino <= R8 Password Hash Extraction Exploit # Google Dork: inurl:namesnsf?opendatabase # Date: 02-24-2016 # Exploit Author: Jonathan Broche # Contact: twittercom/g0jhonny # Vendor Homepage: www-01ibmcom/software/lotus/category/messaging/ # Tested on: Lotus Domino 85 # CVE : CVE-2005-2428 1 Desc ...

Useful pentesting scripts

Pentesting-Scripts A collection of scripts I've used on pentests Hopefully they can be of use to others as well Domino Effect EasyScope Clickjacking POC Whois PermIt Installation Run pip install -r requirementstxt within the cloned tool directory Domino Effect Domino effect exploits an IBM Domino Database Security Bypass vulnerability, CVE-2005-2428, to extract pas

NVD-CWE-Other http://www.cybsec.com/vuln/default_configuration_information_disclosure_lotus_domino.pdf http://www-1.ibm.com/support/docview.wss?uid=swg21212934 http://secunia.com/advisories/16231/http://www.securiteam.com/securitynews/5FP0E15GLQ.html http://www.securityfocus.com/bid/14389 http://www.osvdb.org/18462 http://securitytracker.com/id?1014584 http://marc.info/?l=bugtraq&m=112240869130356&w=2 https://exchange.xforce.ibmcloud.com/vulnerabilities/21556 https://www.exploit-db.com/exploits/39495/https://nvd.nist.gov https://github.com/gojhonny/Pentesting-Scripts https://packetstormsecurity.com/files/54436/lotus.sh.txt.html https://www.exploit-db.com/exploits/3302/

CVE-2005-2428

Vulnerability Summary

Exploits

Github Repositories

References

Vulmon Search

About

Products

Connect