PT-2010-2813 · Dede · Dedecms

Publicado 2010-03-24 · Atualizado 2010-12-14 · CVE-2010-1097

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions DeDeCMS version 5.5 GBK

Description The issue allows remote attackers to bypass authentication and gain administrative access. This is achieved by setting the SESSION[dede admin id] parameter to 1 when session.auto start is enabled. An example of exploitation is a request to "uploads/include/dialog/select soft post.php".

Recommendations For DeDeCMS version 5.5 GBK, consider disabling the session.auto start feature to prevent exploitation. Additionally, restrict access to the "uploads/include/dialog/select soft post.php" endpoint to minimize the risk of unauthorized administrative access. Avoid using the SESSION[dede admin id] parameter in sensitive operations until the issue is resolved.

Exploit

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2010-1097

Produtos afetados

Dedecms

Referências · 6

• 🔥 http://securityfocus.com/bid/38469 · Exploit
• 🔥 http://bbs.wolvez.org/topic/125 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2010-1097 · Nota de Segurança
• http://secunia.com/advisories/38790 · Aviso do Fabricante
• http://osvdb.org/62622 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1097 · Nota