exploitDog

CVE-2007-4338

Опубликовано: 14 авг. 2007

Источник: nvd

CVSS2: 10

EPSS Низкий

Описание

index.php in Ryan Haudenschilt Family Connections (FCMS) before 0.9 allows remote attackers to access an arbitrary account by placing the account's name in the value of an fcms_login_id cookie. NOTE: this can be leveraged for code execution via a POST with PHP code in the content parameter.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:haudenschilt:family_connections_cms:*:*:*:*:*:*:*:*

Версия до 0.8 (включая)

cpe:2.3:a:haudenschilt:family_connections_cms:0.1.1:*:*:*:*:*:*:*

cpe:2.3:a:haudenschilt:family_connections_cms:0.1.2:*:*:*:*:*:*:*

cpe:2.3:a:haudenschilt:family_connections_cms:0.5:*:*:*:*:*:*:*

cpe:2.3:a:haudenschilt:family_connections_cms:0.6:*:*:*:*:*:*:*

EPSS

Процентиль: 95%

0.08925

Низкий

10 Critical

CVSS2

Дефекты

CWE-264

Связанные уязвимости

GHSA-x2f3-hqgw-x6gp

github

больше 4 лет назад

index.php in Ryan Haudenschilt Family Connections (FCMS) before 0.9 allows remote attackers to access an arbitrary account by placing the account's name in the value of an fcms_login_id cookie. NOTE: this can be leveraged for code execution via a POST with PHP code in the content parameter.

EPSS

Процентиль: 95%

0.08925

Низкий

10 Critical

CVSS2

Дефекты

CWE-264

Уязвимость CVE-2007-4338