PT-2007-4866 · Vrnews · Vrnews

R4M! · Publicado 2007-07-06 · Atualizado 2017-09-29 · CVE-2007-3611

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions VRNews versions 1.1.1 and possibly other 1.x versions

Description The issue allows remote attackers to perform certain administrative actions without authentication. This can be achieved by sending a direct request with specific values in the act parameter, such as edit, add, config, or del.

Recommendations For VRNews version 1.1.1, consider restricting access to the admin.php file until a proper authentication mechanism is implemented. For other potentially affected 1.x versions, apply the same restriction to the admin.php file to prevent unauthorized administrative actions.

Exploit

Correção

Identificadores relacionados

CVE-2007-3611

Produtos afetados

Vrnews

Referências · 4

• 🔥 https://exploit-db.com/exploits/4150 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-3611 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35271 · Nota
• http://osvdb.org/45787 · Nota