PT-2008-4698 · Ezwebalbum · Ezwebalbum

Zh_Virangar · Published 2008-07-24 · Updated 2017-09-29 · CVE-2008-3292

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: EZWebAlbum version 1.0

Description: The issue allows remote attackers to bypass authentication and gain administrator privileges. This can be achieved by setting the photoalbumadmin cookie, as demonstrated via the "addpage.php" endpoint.

Recommendations: For EZWebAlbum version 1.0, consider disabling the addpage.php endpoint until a patch is available to prevent exploitation. Restrict access to administrator privileges to minimize the risk of unauthorized access. Avoid using the photoalbumadmin cookie in the affected endpoint until the issue is resolved.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2008-3292

Affected Products

Ezwebalbum

References · 5

• 🔥 https://exploit-db.com/exploits/6115 · Exploit
• 🔥 http://securityfocus.com/bid/30343 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-3292 · Security Note
• http://securityreason.com/securityalert/4033 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43938 · Note