PT-2007-5523 · Unknown · Family Connections Cms

Published 2007-08-14 · Updated 2018-10-15 · CVE-2007-4338

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Family Connections (FCMS) versions prior to 0.9

Description The issue allows remote attackers to access an arbitrary account by manipulating the fcms login id cookie. This can be further exploited for code execution by sending a POST request with PHP code in the content parameter.

Recommendations For versions prior to 0.9, consider restricting access to the index.php file until a patch is available. As a temporary workaround, avoid using the fcms login id cookie and restrict the content parameter in POST requests to prevent code execution.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2007-4338

Affected Products

Family Connections Cms

References · 13

• 🔥 http://securityfocus.com/bid/25276 · Exploit
• 🔥 https://exploit-db.com/exploits/30488 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-4338 · Security Note
• http://secunia.com/advisories/26421 · Vendor Advisory
• http://attrition.org/pipermail/vim/2007-August/001768.html · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4338 · Note
• http://sourceforge.net/tracker/index.php?func=detail&aid=1778696&group_id=189733&atid=930513 · Note
• http://securityfocus.com/archive/1/476293/100/0/threaded · Note
• http://osvdb.org/39534 · Note
• http://securityreason.com/securityalert/3009 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35966 · Note
• http://attrition.org/pipermail/vim/2007-August/001762.html · Note
• http://securityfocus.com/archive/1/476142/100/0/threaded · Note