PT-2011-1330 · Cre Loaded · Cre Loaded

Published 2011-06-08 · Updated 2024-02-14 · CVE-2009-5076

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions CRE Loaded versions prior to 6.3.x CRE Loaded version 6.2.14 and earlier

Description The issue allows remote attackers to bypass authentication and gain administrator privileges. This is achieved by sending a request with specific PHP files, such as login.php or password forgotten.php, appended as the PATH INFO, which bypasses a check using PHP SELF. The vulnerability is due to improper handling in includes/application top.php and admin/includes/application top.php. It has been exploited in the wild.

Recommendations For CRE Loaded versions prior to 6.3.x, update to version 6.3.x or later. For CRE Loaded version 6.2.14 and earlier, update to version 6.2.14 or later. As a temporary workaround, consider restricting access to login.php and password forgotten.php to minimize the risk of exploitation.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2009-5076

Affected Products

Cre Loaded

References · 3

• 🔥 http://hosting-4-creloaded.com/node/116 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-5076 · Security Note
• https://creloaded.com/fdm_file_detail.php?file_id=191 · Vendor Advisory