PT-2009-2143 · Quickersite · Quickersite

Published 2009-04-08 · Updated 2009-04-23 · CVE-2008-6673

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions QuickerSite version 1.8.5

Description The issue allows remote attackers to access administrative functionality without proper restrictions. This enables them to change the admin password via the cSaveAdminPW action, modify site information such as the contact address via the saveAdmin action, and modify the site design via the saveDesign action.

Recommendations For QuickerSite version 1.8.5, restrict access to the administrative functionality to prevent unauthorized changes. As a temporary workaround, consider disabling the cSaveAdminPW, saveAdmin, and saveDesign actions until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2008-6673

Affected Products

Quickersite

References · 7

• 🔥 https://exploit-db.com/exploits/5733 · Exploit
• 🔥 http://bugreport.ir/index_39.htm · Exploit
• 🔥 http://bugreport.ir/39/exploit.htm · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-6673 · Security Note
• http://secunia.com/advisories/30501 · Vendor Advisory
• http://securityfocus.com/bid/29524 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-6673 · Note