PT-2009-6384 · Phpbazar · Phpbazar

Published 2009-12-07 · Updated 2009-12-08 · CVE-2009-4222

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions phpBazar versions 2.1.1fix and earlier

Description The issue allows remote attackers to gain access to the admin control panel without proper administrative authentication. This is possible by making a direct request to the admin control panel.

Recommendations For phpBazar versions 2.1.1fix and earlier, ensure that proper authentication mechanisms are implemented to restrict access to the admin control panel, specifically for the admin/admin.php page. As a temporary workaround, consider restricting direct access to the admin/admin.php page until a proper fix is applied.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2009-4222

Affected Products

Phpbazar

References · 5

• 🔥 https://exploit-db.com/exploits/10233 · Exploit
• 🔥 http://securityfocus.com/bid/37132 · Exploit
• 🔥 http://packetstormsecurity.org/0911-exploits/phpbazar-access.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-4222 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4222 · Note