PT-2007-1733 · Snews · Snews

Rgod · Published 2007-01-16 · Updated 2017-10-19 · CVE-2007-0261

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions sNews versions 1.5.30 and earlier

Description The issue allows remote attackers to perform unauthorized administrative actions when authentication fails. This can be demonstrated by changing an administrative password via the 'changeup task' or by uploading PHP code via the imagefile parameter.

Recommendations For sNews versions 1.5.30 and earlier, consider disabling the changeup task and restricting access to the imagefile parameter until a fix is available. Additionally, restrict administrative actions to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2007-0261

Affected Products

Snews

References · 7

• 🔥 https://exploit-db.com/exploits/3116 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-0261 · Security Note
• http://secunia.com/advisories/23746 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/31535 · Note
• http://securityfocus.com/bid/22025 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0261 · Note
• http://osvdb.org/32817 · Note