PT-2009-4241 · Flyspeck · Flyspeck Cms

Ahmadbady · Published 2009-05-22 · Updated 2017-09-29 · CVE-2009-1771

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Flyspeck CMS version 6.8

Description: The issue allows remote attackers to create or modify admin accounts without requiring administrative authentication for the updateExistingContent action. This is achieved by manipulating specific parameters in the request, including users[fullname], users[email], users[role id], users[username], and users[password].

Recommendations: For Flyspeck CMS version 6.8, ensure that administrative authentication is properly enforced for the updateExistingContent action to prevent unauthorized modifications to admin accounts. As a temporary workaround, consider restricting access to the updateExistingContent action until a proper fix is implemented.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2009-1771

Affected Products

Flyspeck Cms

References · 4

• 🔥 http://securityfocus.com/bid/35011 · Exploit
• 🔥 https://exploit-db.com/exploits/8714 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-1771 · Security Note
• http://vupen.com/english/advisories/2009/1367 · Note