PT-2009-2593 · Zkup · Zkup Cms

Charles Fol + 1 · Published 2009-08-31 · Updated 2017-09-29 · CVE-2008-7124

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions zKup CMS versions 2.0 through 2.3

Description The issue allows remote attackers to gain administrator privileges without requiring administrative authentication for the admin/configuration/modifier.php endpoint. This can be achieved by making a direct request to this endpoint, for example, by adding a new administrator.

Recommendations For zKup CMS versions 2.0 through 2.3, consider restricting access to the admin/configuration/modifier.php endpoint until a proper fix is available. As a temporary workaround, limit the ability to add new administrators to prevent unauthorized access.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2008-7124

Affected Products

Zkup Cms

References · 8

• 🔥 https://exploit-db.com/exploits/5219 · Exploit
• 🔥 https://exploit-db.com/exploits/5220 · Exploit
• 🔥 http://securityfocus.com/bid/28149 · Exploit
• http://secunia.com/advisories/29276 · Vendor Advisory
• http://zkup.fr/actualite-zkup/maj-critique-v203v204.html · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2008-7124 · Security Note
• http://osvdb.org/43081 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41068 · Note