PT-2009-4620 · Egyplus · Egyplus 7Ammel

Qabandi · Publicado 2009-06-22 · Atualizado 2025-01-21 · CVE-2009-2168

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions EgyPlus 7ammel (aka 7ml) versions 1.0.1 and earlier

Description The issue allows remote attackers to bypass authentication by providing arbitrary username and password parameters. This occurs because cpanel/login.php sends a redirect to the web browser but does not exit when the supplied credentials are incorrect.

Recommendations For EgyPlus 7ammel (aka 7ml) versions 1.0.1 and earlier, consider disabling the login functionality in cpanel/login.php until a patch is available. Restrict access to the cpanel/login.php endpoint to minimize the risk of exploitation. Avoid using arbitrary username and password parameters in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2009-2168

Produtos afetados

Egyplus 7Ammel

Referências · 3

• 🔥 https://exploit-db.com/exploits/8865 · Exploit
• https://t.me/cvenotify/108044 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2009-2168 · Nota de Segurança