high7.5Public exploit code
CVE-2009-1771
index.php in Flyspeck CMS 6.8 does not require administrative authentication for the updateExistingContent action, which allows remote attackers to create or m…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Flyspeck CMS 6.8 - Local/Remote File Inclusion / Change Add Admin2009-05-18 · webapps · php · Verified
Impact
index.php in Flyspeck CMS 6.8 does not require administrative authentication for the updateExistingContent action, which allows remote attackers to create or modify admin accounts via the (1) users[fullname], (2) users[email], (3) users[role_id], (4) users[username], and (5) users[password] parameters.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Flyspeck | Flyspeck Cms | Version 6.8 |