PT-2008-3513 · Acidcat · Acidcat Cms

Published 2008-04-27 · Updated 2018-10-11 · CVE-2008-1992

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Acidcat CMS version 3.4.1

Description The issue allows remote attackers to bypass access restrictions to certain files, specifically default mail aspemail.asp, default mail cdosys.asp, and default mail jmail.asp, enabling them to relay email messages with modified From, FromName, and To fields.

Recommendations For Acidcat CMS version 3.4.1, restrict access to the vulnerable files default mail aspemail.asp, default mail cdosys.asp, and default mail jmail.asp to prevent email relay attacks.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2008-1992

Affected Products

Acidcat Cms

References · 9

• 🔥 https://exploit-db.com/exploits/5478 · Exploit
• 🔥 http://bugreport.ir/index.php?/36 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-1992 · Security Note
• http://secunia.com/advisories/29916 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1992 · Note
• http://securityfocus.com/bid/28868 · Note
• http://securityfocus.com/archive/1/491129/100/0/threaded · Note
• http://securityreason.com/securityalert/3842 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41921 · Note