critical9.3Public exploit code
CVE-2008-3033
RSS-aggregator 1.0 does not require administrative authentication for the admin/fonctions/ directory, which allows remote attackers to access admin functions a…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- RSS-aggregator 1.0 - Authentication Bypass2008-06-30 · webapps · php · Verified
Impact
RSS-aggregator 1.0 does not require administrative authentication for the admin/fonctions/ directory, which allows remote attackers to access admin functions and have unspecified other impact, as demonstrated by (1) an IdFlux request to supprimer_flux.php and (2) a TpsRafraich request to modifier_tps_rafraich.php.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Rss Aggregator | Rss Aggregator | Version 1.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://securityreason.com/securityalert/3975
- http://www.securityfocus.com/archive/1/493783/100/0/threaded
- http://www.securityfocus.com/bid/30016
- https://exchange.xforce.ibmcloud.com/vulnerabilities/43509
- http://securityreason.com/securityalert/3975
- http://www.securityfocus.com/archive/1/493783/100/0/threaded
- http://www.securityfocus.com/bid/30016
- https://exchange.xforce.ibmcloud.com/vulnerabilities/43509