PT-2009-2593 · Zkup · Zkup Cms

Charles Fol + 1 · Publicado 2009-08-31 · Atualizado 2017-09-29 · CVE-2008-7124

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions zKup CMS versions 2.0 through 2.3

Description The issue allows remote attackers to gain administrator privileges without requiring administrative authentication for the admin/configuration/modifier.php endpoint. This can be achieved by making a direct request to this endpoint, for example, by adding a new administrator.

Recommendations For zKup CMS versions 2.0 through 2.3, consider restricting access to the admin/configuration/modifier.php endpoint until a proper fix is available. As a temporary workaround, limit the ability to add new administrators to prevent unauthorized access.

Exploit

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2008-7124

Produtos afetados

Zkup Cms

Referências · 8

• 🔥 https://exploit-db.com/exploits/5219 · Exploit
• 🔥 https://exploit-db.com/exploits/5220 · Exploit
• 🔥 http://securityfocus.com/bid/28149 · Exploit
• http://secunia.com/advisories/29276 · Aviso do Fabricante
• http://osvdb.org/43081 · Nota
• http://zkup.fr/actualite-zkup/maj-critique-v203v204.html · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2008-7124 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41068 · Nota