high7.5Public exploit code
CVE-2005-3010
Direct static code injection vulnerability in the flood protection feature in inc/shows.inc.php in CuteNews 1.4.0 and earlier allows remote attackers to execut…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- CuteNews 1.4.0 - Shell Injection / Remote Command Execution2005-09-17 · webapps · php · Verified
Impact
Direct static code injection vulnerability in the flood protection feature in inc/shows.inc.php in CuteNews 1.4.0 and earlier allows remote attackers to execute arbitrary PHP code via the HTTP_CLIENT_IP header (Client-Ip), which is injected into data/flood.db.php.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Cutephp | Cutenews | through 1.4.0 |