PT-2009-6164 · Vivaprograms · Vivaprograms Infinity

Qabandi · Publicado 2009-11-16 · Atualizado 2017-09-19 · CVE-2009-3949

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions VivaPrograms Infinity versions 2.0.5 and earlier

Description The issue allows remote attackers to create administrative accounts without requiring administrative authentication. This is achieved through the name, password, and conf password parameters in the cp/profile.php endpoint.

Recommendations For versions 2.0.5 and earlier, consider disabling the donewauthor action in the cp/profile.php endpoint until a patch is available. Restrict access to the cp/profile.php endpoint to minimize the risk of exploitation. Avoid using the name, password, and conf password parameters in the affected endpoint until the issue is resolved.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2009-3949

Produtos afetados

Vivaprograms Infinity

Referências · 4

• 🔥 https://exploit-db.com/exploits/9159 · Exploit
• 🔥 http://exploit-db.com/exploits/9159 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/51779 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-3949 · Nota de Segurança