high7.5Public exploit code
CVE-2009-2025
admin/login.php in DM FileManager 3.9.2 allows remote attackers to bypass authentication and gain administrative access by setting the (1) USER, (2) GROUPID, (…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- DM FileManager 3.9.2 - Insecure Cookie Handling2009-06-08 · webapps · php · Verified
Impact
admin/login.php in DM FileManager 3.9.2 allows remote attackers to bypass authentication and gain administrative access by setting the (1) USER, (2) GROUPID, (3) GROUP, and (4) USERID cookies to certain values.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Dutchmonkey | Dm Filemanager | Version 3.9.2 |