medium6.8Public exploit code
CVE-2008-7024
admin.php in Arz Development The Gemini Portal 4.7 and earlier allows remote attackers to bypass authentication and gain administrator privileges by setting th…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- The Gemini Portal 4.7 - Insecure Cookie Handling2008-09-26 · webapps · php · Verified
Impact
admin.php in Arz Development The Gemini Portal 4.7 and earlier allows remote attackers to bypass authentication and gain administrator privileges by setting the user cookie to "admin" and setting the name parameter to "users."
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Arzdev | Gemini Lite | Versions 3.5, 3.6 |
| Arzdev | Gemini Portal | Version 4.7 |
Weakness classification
References
- NVD record
- CVE.org record
- http://osvdb.org/48639
- http://secunia.com/advisories/32057
- http://www.securityfocus.com/archive/1/496761/100/0/threaded
- http://www.securityfocus.com/bid/31429
- https://exchange.xforce.ibmcloud.com/vulnerabilities/45439
- https://www.exploit-db.com/exploits/6584
- http://osvdb.org/48639
- http://secunia.com/advisories/32057
- http://www.securityfocus.com/archive/1/496761/100/0/threaded
- http://www.securityfocus.com/bid/31429
- https://exchange.xforce.ibmcloud.com/vulnerabilities/45439
- https://www.exploit-db.com/exploits/6584