PT-2009-4241 · Flyspeck · Flyspeck Cms

Ahmadbady · Publicado 2009-05-22 · Atualizado 2017-09-29 · CVE-2009-1771

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Flyspeck CMS version 6.8

Description: The issue allows remote attackers to create or modify admin accounts without requiring administrative authentication for the updateExistingContent action. This is achieved by manipulating specific parameters in the request, including users[fullname], users[email], users[role id], users[username], and users[password].

Recommendations: For Flyspeck CMS version 6.8, ensure that administrative authentication is properly enforced for the updateExistingContent action to prevent unauthorized modifications to admin accounts. As a temporary workaround, consider restricting access to the updateExistingContent action until a proper fix is implemented.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2009-1771

Produtos afetados

Flyspeck Cms

Referências · 4

• 🔥 http://securityfocus.com/bid/35011 · Exploit
• 🔥 https://exploit-db.com/exploits/8714 · Exploit
• http://vupen.com/english/advisories/2009/1367 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-1771 · Nota de Segurança