PT-2008-4628 · Scripteen · Scripteen Free Image Hosting Script

Published 2008-07-18 · Updated 2017-09-29 · CVE-2008-3211

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Scripteen Free Image Hosting Script versions 1.2 through 1.2.1

Description: The issue allows remote attackers to bypass authentication and gain administrative access. This is achieved by setting the cookid cookie value to 1, effectively allowing unauthorized access to administrative functions.

Recommendations: For Scripteen Free Image Hosting Script versions 1.2 through 1.2.1, consider restricting access to administrative areas until a fix is available, and avoid using the cookid cookie as a sole means of authentication. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2008-3211

Affected Products

Scripteen Free Image Hosting Script

References · 7

• 🔥 https://exploit-db.com/exploits/6070 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-3211 · Security Note
• http://secunia.com/advisories/31083 · Vendor Advisory
• http://vupen.com/english/advisories/2008/2106/references · Note
• http://securityreason.com/securityalert/4014 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43771 · Note
• http://securityfocus.com/bid/30217 · Note