PT-2018-13452 · Damicms · Damicms

Howchen · Publicado 2018-08-30 · Atualizado 2019-10-03 · CVE-2018-16239

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions damiCMS version 6.0.1

Description An issue was discovered where the software relies on the PHP time() function for cookies. This makes it possible to determine the cookie for an existing admin session via a certain number of guesses.

Recommendations For damiCMS version 6.0.1, consider implementing a more secure method for generating cookies to prevent guessing attacks. As a temporary workaround, restrict access to admin sessions to minimize the risk of exploitation.

Exploit

Correção

Use of Insufficiently Random Values

Enumeração de Fraquezas

CWE-330

Identificadores relacionados

CVE-2018-16239

Produtos afetados

Damicms

Referências · 3

• 🔥 https://github.com/howchen/howchen/issues/2 · Exploit
• https://osv.dev/vulnerability/CVE-2018-16239 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-16239 · Nota de Segurança