PAD CMS Client-Side Brute-Force Protection Bypass Vulnerability

A vulnerability exists in PAD CMS due to weak client-side brute-force protection implemented with two cookies, login_count and login_timeout. This information is not stored on the server, allowing attackers to bypass brute-force defenses by resetting these cookies. The vulnerability affects all three templates: www, bip, and www+bip.

Impact

Exploitation of this vulnerability allows attackers to bypass brute-force protection mechanisms, potentially leading to unauthorized access or account compromise.