Описание
zKup CMS 2.0 through 2.3 does not require administrative authentication for admin/configuration/modifier.php, which allows remote attackers to gain administrator privileges via a direct request, as demonstrated by adding a new administrator.
Ссылки
- Vendor Advisory
- Exploit
- Patch
- Vendor Advisory
- Exploit
- Patch
Уязвимые конфигурации
Конфигурация 1
Одно из
cpe:2.3:a:zkup:zkup:2.0:*:*:*:*:*:*:*
cpe:2.3:a:zkup:zkup:2.01:*:*:*:*:*:*:*
cpe:2.3:a:zkup:zkup:2.02:*:*:*:*:*:*:*
cpe:2.3:a:zkup:zkup:2.03:*:*:*:*:*:*:*
EPSS
Процентиль: 92%
0.0816
Низкий
7.5 High
CVSS2
Дефекты
CWE-287
Связанные уязвимости
github
больше 3 лет назад
zKup CMS 2.0 through 2.3 does not require administrative authentication for admin/configuration/modifier.php, which allows remote attackers to gain administrator privileges via a direct request, as demonstrated by adding a new administrator.
EPSS
Процентиль: 92%
0.0816
Низкий
7.5 High
CVSS2
Дефекты
CWE-287