exploitDog

CVE-2007-4338

Опубликовано: 14 авг. 2007

Источник: nvd

CVSS2: 10

EPSS Средний

Описание

index.php in Ryan Haudenschilt Family Connections (FCMS) before 0.9 allows remote attackers to access an arbitrary account by placing the account's name in the value of an fcms_login_id cookie. NOTE: this can be leveraged for code execution via a POST with PHP code in the content parameter.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:haudenschilt:family_connections_cms:*:*:*:*:*:*:*:*

Версия до 0.8 (включая)

cpe:2.3:a:haudenschilt:family_connections_cms:0.1.1:*:*:*:*:*:*:*

cpe:2.3:a:haudenschilt:family_connections_cms:0.1.2:*:*:*:*:*:*:*

cpe:2.3:a:haudenschilt:family_connections_cms:0.5:*:*:*:*:*:*:*

cpe:2.3:a:haudenschilt:family_connections_cms:0.6:*:*:*:*:*:*:*

EPSS

Процентиль: 97%

0.31993

Средний

10 Critical

CVSS2

Дефекты

CWE-264

Связанные уязвимости

GHSA-x2f3-hqgw-x6gp

github

почти 4 года назад

index.php in Ryan Haudenschilt Family Connections (FCMS) before 0.9 allows remote attackers to access an arbitrary account by placing the account's name in the value of an fcms_login_id cookie. NOTE: this can be leveraged for code execution via a POST with PHP code in the content parameter.

EPSS

Процентиль: 97%

0.31993

Средний

10 Critical

CVSS2

Дефекты

CWE-264