PT-2009-6341 · Cutenews · Cutenews

Published 2009-12-02 · Updated 2018-10-10 · CVE-2009-4173

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions CuteNews versions 1.4.6 and earlier, UTF-8 CuteNews versions prior to 8b

Description A cross-site request forgery issue allows remote attackers to hijack administrator authentication for creating new users, including administrators, by exploiting the adduser action in the editusers module in index.php.

Recommendations For CuteNews version 1.4.6 and earlier, update to a version later than 1.4.6. For UTF-8 CuteNews versions prior to 8b, update to version 8b or later.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2009-4173

Affected Products

Cutenews

References · 7

• 🔥 http://securityfocus.com/bid/36971 · Exploit
• 🔥 https://exploit-db.com/exploits/10002 · Exploit
• 🔥 http://morningstarsecurity.com/advisories/MORNINGSTAR-2009-02-CuteNews.txt · Exploit
• 🔥 https://exploit-db.com/exploits/33344 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-4173 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54240 · Note
• http://securityfocus.com/archive/1/507782/100/0/threaded · Note