PT-2007-5523 · Unknown · Family Connections Cms

Publicado 2007-08-14 · Atualizado 2018-10-15 · CVE-2007-4338

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Family Connections (FCMS) versions prior to 0.9

Description The issue allows remote attackers to access an arbitrary account by manipulating the fcms login id cookie. This can be further exploited for code execution by sending a POST request with PHP code in the content parameter.

Recommendations For versions prior to 0.9, consider restricting access to the index.php file until a patch is available. As a temporary workaround, avoid using the fcms login id cookie and restrict the content parameter in POST requests to prevent code execution.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2007-4338

Produtos afetados

Family Connections Cms

Referências · 13

• 🔥 http://securityfocus.com/bid/25276 · Exploit
• 🔥 https://exploit-db.com/exploits/30488 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-4338 · Nota de Segurança
• http://secunia.com/advisories/26421 · Aviso do Fabricante
• http://attrition.org/pipermail/vim/2007-August/001768.html · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4338 · Nota
• http://sourceforge.net/tracker/index.php?func=detail&aid=1778696&group_id=189733&atid=930513 · Nota
• http://securityfocus.com/archive/1/476293/100/0/threaded · Nota
• http://osvdb.org/39534 · Nota
• http://securityreason.com/securityalert/3009 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35966 · Nota
• http://attrition.org/pipermail/vim/2007-August/001762.html · Nota
• http://securityfocus.com/archive/1/476142/100/0/threaded · Nota