PT-2018-13452 · Damicms · Damicms

Howchen · Published 2018-08-30 · Updated 2019-10-03 · CVE-2018-16239

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions damiCMS version 6.0.1

Description An issue was discovered where the software relies on the PHP time() function for cookies. This makes it possible to determine the cookie for an existing admin session via a certain number of guesses.

Recommendations For damiCMS version 6.0.1, consider implementing a more secure method for generating cookies to prevent guessing attacks. As a temporary workaround, restrict access to admin sessions to minimize the risk of exploitation.

Exploit

Fix

Use of Insufficiently Random Values

Weakness Enumeration

CWE-330

Related Identifiers

CVE-2018-16239

Affected Products

Damicms

References · 3

• 🔥 https://github.com/howchen/howchen/issues/2 · Exploit
• https://osv.dev/vulnerability/CVE-2018-16239 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-16239 · Security Note