critical9.3Public exploit code
CVE-2007-3611
admin.php in VRNews 1.1.1, and possibly other 1.x versions, does not require authentication, which allows remote attackers to perform certain administrative ac…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- VRNews 1.1.1 - 'admin.php' Remote Security Bypass2007-07-05 · webapps · php · Verified
Impact
admin.php in VRNews 1.1.1, and possibly other 1.x versions, does not require authentication, which allows remote attackers to perform certain administrative actions via a direct request with a (1) edit, (2) add, (3) config, or (4) del value in the act parameter.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Vrnews | Vrnews | Version 1.1.1 |