critical9.8Public exploit code
CVE-2014-9148
Fiyo CMS 2.0.1.8 allows remote attackers to bypass intended access restrictions and execute the (1) "Install and Update" or (2) Backup super administrator func…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Fiyo CMS 2.0.1.8 - Multiple Vulnerabilities2015-03-31 · webapps · php
Impact
Fiyo CMS 2.0.1.8 allows remote attackers to bypass intended access restrictions and execute the (1) "Install and Update" or (2) Backup super administrator function via the view parameter in a direct request to fiyo/dapur.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Fiyo | Fiyo Cms | through 2.0.1.8 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/131165/FiyoCMS-2.0.1.8-XSS-SQL-Injection-URL-Bypass.html
- http://www.securityfocus.com/bid/73437
- https://www.exploit-db.com/exploits/36581/
- http://packetstormsecurity.com/files/131165/FiyoCMS-2.0.1.8-XSS-SQL-Injection-URL-Bypass.html
- http://www.securityfocus.com/bid/73437
- https://www.exploit-db.com/exploits/36581/