medium4.0Public exploit code
CVE-2009-1825
modules/admuser.php in myColex 1.4.2 does not require administrative authentication, which allows remote authenticated users to list user accounts via a Find a…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- my-colex 1.4.2 - Authentication Bypass / SQL Injection / Cross-Site Scripting2009-05-15 · webapps · php · Verified
Impact
modules/admuser.php in myColex 1.4.2 does not require administrative authentication, which allows remote authenticated users to list user accounts via a Find action.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Collector | Mycolex | Version 1.4.2 |