PT-2009-2520 · Aj Square · Aj Square Aj Article

G4N0K · Published 2009-08-24 · Updated 2017-09-29 · CVE-2008-7051

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions AJ Square AJ Article (affected versions not specified)

Description The issue allows remote attackers to bypass authentication and access administrator functionality. This can be achieved by making a direct request to various API endpoints, including "user.php", "articles.php", "articlesuspend.php", "site.php", "statistics.php", "mail.php", "category.php", "subcategory.php", "changepassword.php", "polling.php", and "logo.php" in the "admin/" directory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2008-7051

Affected Products

Aj Square Aj Article

References · 4

• 🔥 http://securityfocus.com/bid/32254 · Exploit
• 🔥 https://exploit-db.com/exploits/7081 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-7051 · Security Note
• http://vupen.com/english/advisories/2008/3097 · Vendor Advisory