critical10.0Public exploit code
CVE-2004-0621
admin.php in Newsletter ZWS allows remote attackers to gain administrative privileges via a list_user operation with the ulevel parameter set to 1 (administrat…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- ZaireWeb Solutions NewsLetter ZWS - Administrative Interface Authentication Bypass2004-06-24 · webapps · php · Verified
Impact
admin.php in Newsletter ZWS allows remote attackers to gain administrative privileges via a list_user operation with the ulevel parameter set to 1 (administrator level), which lists all users and their passwords.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Zaireweb Solutions | Newsletter Zws | All versions |
References
- NVD record
- CVE.org record
- http://marc.info/?l=bugtraq&m=108811585025216&w=2
- http://www.securityfocus.com/bid/10605
- https://exchange.xforce.ibmcloud.com/vulnerabilities/16507
- http://marc.info/?l=bugtraq&m=108811585025216&w=2
- http://www.securityfocus.com/bid/10605
- https://exchange.xforce.ibmcloud.com/vulnerabilities/16507