PT-2007-1353 · Smartsitecms · Smartsitecms

Paulino Calderon · Published 2007-02-27 · Updated 2017-07-29 · CVE-2006-7074

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SmartSiteCMS version 1.0

Description The issue allows remote attackers to bypass authentication and gain administrator privileges. This is achieved by setting the userName cookie in the admin.php file.

Recommendations For SmartSiteCMS version 1.0, consider restricting access to the admin.php file until a patch is available. As a temporary workaround, avoid using the userName cookie in the affected file to minimize the risk of exploitation.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2006-7074

Affected Products

Smartsitecms

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2006-7074 · Security Note
• http://secunia.com/advisories/20769 · Vendor Advisory
• http://securityfocus.com/bid/19434 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28299 · Note
• http://marc.info/?l=full-disclosure&m=115510147417471&w=2 · Note