medium5.0Public exploit code
CVE-2000-0720
news.cgi in GWScripts News Publisher does not properly authenticate requests to add an author to the author index, which allows remote attackers to add new aut…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- GWScripts News Publisher 1.0 - 'author.file' Write2000-08-29 · remote · cgi · Verified
Impact
news.cgi in GWScripts News Publisher does not properly authenticate requests to add an author to the author index, which allows remote attackers to add new authors by directly posting an HTTP request to the new.cgi program with an addAuthor parameter, and setting the Referer to the news.cgi program.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Gwscripts | Gwscripts News Publisher | Versions 1.05, 1.05a, 1.05b, 1.06 |
References
- NVD record
- CVE.org record
- http://www.securityfocus.com/bid/1621
- http://www.securityfocus.com/templates/archive.pike?list=1&msg=003301c0123b%2418f8c1a0%24953b29d4%40e8s9s4
- https://exchange.xforce.ibmcloud.com/vulnerabilities/5169
- http://www.securityfocus.com/bid/1621
- http://www.securityfocus.com/templates/archive.pike?list=1&msg=003301c0123b%2418f8c1a0%24953b29d4%40e8s9s4
- https://exchange.xforce.ibmcloud.com/vulnerabilities/5169