medium5.0Public exploit code
CVE-2008-6643
LokiCMS 0.3.4 and possibly earlier versions does not properly restrict access to administrative functions, which allows remote attackers to bypass intended res…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- LokiCMS 0.3.4 - 'writeconfig()' Remote Command Execution2008-10-13 · webapps · php · Verified
Impact
LokiCMS 0.3.4 and possibly earlier versions does not properly restrict access to administrative functions, which allows remote attackers to bypass intended restrictions and modify configuration settings via the LokiACTION parameter in a direct request to admin.php.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Lokicms | Lokicms | Version 0.3.4 |
Weakness classification
References
- NVD record
- CVE.org record
- http://osvdb.org/45866
- http://www.securityfocus.com/archive/1/492877/100/0/threaded
- http://www.securityfocus.com/bid/29448
- https://exchange.xforce.ibmcloud.com/vulnerabilities/42766
- http://osvdb.org/45866
- http://www.securityfocus.com/archive/1/492877/100/0/threaded
- http://www.securityfocus.com/bid/29448
- https://exchange.xforce.ibmcloud.com/vulnerabilities/42766