high7.5Public exploit code
CVE-2008-6553
microcms-admin-home.php in Implied by Design Micro CMS (Micro-CMS) 3.5 (aka 0.3.5) does not require authentication as an administrator, which allows remote att…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Micro CMS 0.3.5 - Remote Add/Delete/Password Change2008-11-01 · webapps · php · Verified
Impact
microcms-admin-home.php in Implied by Design Micro CMS (Micro-CMS) 3.5 (aka 0.3.5) does not require authentication as an administrator, which allows remote attackers to (1) create administrative accounts via an add_admin action, (2) remove administrative accounts via a delete_admin action, and (3) modify administrative passwords via a change_password action.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Impliedbydesign | Micro-Cms | through 0.3.5 |
Weakness classification
References
- NVD record
- CVE.org record
- http://downloads.securityfocus.com/vulnerabilities/exploits/32063.pl
- http://www.securityfocus.com/bid/32063
- https://exchange.xforce.ibmcloud.com/vulnerabilities/46294
- https://www.exploit-db.com/exploits/6933
- http://downloads.securityfocus.com/vulnerabilities/exploits/32063.pl
- http://www.securityfocus.com/bid/32063
- https://exchange.xforce.ibmcloud.com/vulnerabilities/46294
- https://www.exploit-db.com/exploits/6933