PT-2007-2250 · Les News · Les News

Published 2007-02-07 · Updated 2018-10-16 · CVE-2007-0806

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Les News version 2.2

Description The issue allows remote attackers to bypass authentication and gain administrative access. This can be achieved by making a direct request for the adminews/index fr.php3 endpoint, and possibly the adminews index documents for other localizations.

Recommendations For Les News version 2.2, consider restricting access to the adminews/index fr.php3 endpoint and other potentially vulnerable adminews index documents until a patch is available. As a temporary workaround, limit administrative access to trusted users and networks to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2007-0806

Affected Products

Les News

References · 5

• 🔥 http://forums.avenir-geopolitique.net/viewtopic.php?t=2622 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-0806 · Security Note
• http://securityfocus.com/archive/1/459186/100/0/threaded · Note
• http://securityreason.com/securityalert/2226 · Note
• http://osvdb.org/33686 · Note