PT-2009-6164 · Vivaprograms · Vivaprograms Infinity

Qabandi · Published 2009-11-16 · Updated 2017-09-19 · CVE-2009-3949

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions VivaPrograms Infinity versions 2.0.5 and earlier

Description The issue allows remote attackers to create administrative accounts without requiring administrative authentication. This is achieved through the name, password, and conf password parameters in the cp/profile.php endpoint.

Recommendations For versions 2.0.5 and earlier, consider disabling the donewauthor action in the cp/profile.php endpoint until a patch is available. Restrict access to the cp/profile.php endpoint to minimize the risk of exploitation. Avoid using the name, password, and conf password parameters in the affected endpoint until the issue is resolved.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2009-3949

Affected Products

Vivaprograms Infinity

References · 4

• 🔥 https://exploit-db.com/exploits/9159 · Exploit
• 🔥 http://exploit-db.com/exploits/9159 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-3949 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/51779 · Note