PT-2007-1353 · Smartsitecms · Smartsitecms

Paulino Calderon · Publicado 2007-02-27 · Atualizado 2017-07-29 · CVE-2006-7074

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SmartSiteCMS version 1.0

Description The issue allows remote attackers to bypass authentication and gain administrator privileges. This is achieved by setting the userName cookie in the admin.php file.

Recommendations For SmartSiteCMS version 1.0, consider restricting access to the admin.php file until a patch is available. As a temporary workaround, avoid using the userName cookie in the affected file to minimize the risk of exploitation.

Correção

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

Identificadores relacionados

CVE-2006-7074

Produtos afetados

Smartsitecms

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2006-7074 · Nota de Segurança
• http://secunia.com/advisories/20769 · Aviso do Fabricante
• http://securityfocus.com/bid/19434 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28299 · Nota
• http://marc.info/?l=full-disclosure&m=115510147417471&w=2 · Nota