PT-2008-4903 · Lovecms · Lovecms

Pomdapimp · Published 2008-08-07 · Updated 2017-09-29 · CVE-2008-3509

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions LoveCMS version 1.6.2

Description The issue allows remote attackers to change the configuration or execute arbitrary PHP code due to the lack of administrative authentication for certain files in the system/admin/ directory. Specifically, this affects the addblock.php, blocks.php, and themes.php files.

Recommendations For LoveCMS version 1.6.2, consider restricting access to the addblock.php, blocks.php, and themes.php files in the system/admin/ directory until a patch is available. As a temporary workaround, implement proper administrative authentication for these files to prevent unauthorized changes or code execution.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2008-3509

Affected Products

Lovecms

References · 7

• 🔥 https://exploit-db.com/exploits/6209 · Exploit
• 🔥 https://exploit-db.com/exploits/6210 · Exploit
• http://secunia.com/advisories/31389 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-3509 · Security Note
• http://securityfocus.com/bid/30562 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44227 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44226 · Note