PT-2009-4620 · Egyplus · Egyplus 7Ammel

Qabandi · Published 2009-06-22 · Updated 2025-01-21 · CVE-2009-2168

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions EgyPlus 7ammel (aka 7ml) versions 1.0.1 and earlier

Description The issue allows remote attackers to bypass authentication by providing arbitrary username and password parameters. This occurs because cpanel/login.php sends a redirect to the web browser but does not exit when the supplied credentials are incorrect.

Recommendations For EgyPlus 7ammel (aka 7ml) versions 1.0.1 and earlier, consider disabling the login functionality in cpanel/login.php until a patch is available. Restrict access to the cpanel/login.php endpoint to minimize the risk of exploitation. Avoid using arbitrary username and password parameters in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2009-2168

Affected Products

Egyplus 7Ammel

References · 3

• 🔥 https://exploit-db.com/exploits/8865 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-2168 · Security Note
• https://t.me/cvenotify/108044 · Telegram Post