PT-2009-2143 · Quickersite · Quickersite

Publicado 2009-04-08 · Atualizado 2009-04-23 · CVE-2008-6673

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions QuickerSite version 1.8.5

Description The issue allows remote attackers to access administrative functionality without proper restrictions. This enables them to change the admin password via the cSaveAdminPW action, modify site information such as the contact address via the saveAdmin action, and modify the site design via the saveDesign action.

Recommendations For QuickerSite version 1.8.5, restrict access to the administrative functionality to prevent unauthorized changes. As a temporary workaround, consider disabling the cSaveAdminPW, saveAdmin, and saveDesign actions until a patch is available.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2008-6673

Produtos afetados

Quickersite

Referências · 7

• 🔥 https://exploit-db.com/exploits/5733 · Exploit
• 🔥 http://bugreport.ir/index_39.htm · Exploit
• 🔥 http://bugreport.ir/39/exploit.htm · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-6673 · Nota de Segurança
• http://securityfocus.com/bid/29524 · Nota
• http://secunia.com/advisories/30501 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-6673 · Nota