high7.5Public exploit code
CVE-2009-3949
cp/profile.php in VivaPrograms Infinity 2.0.5 and earlier does not require administrative authentication for the donewauthor action, which allows remote attack…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Infinity 2.0.5 - Arbitrary Create Admin2009-07-15 · webapps · php · Verified
Impact
cp/profile.php in VivaPrograms Infinity 2.0.5 and earlier does not require administrative authentication for the donewauthor action, which allows remote attackers to create administrative accounts via the name, password, and conf_password parameters.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Vivaprograms | Infinity Script | through 2.0.5 Version 2.0.0 |