critical9.8Public exploit code
CVE-2017-14322
The function in charge to check whether the user is already logged in init.php in Interspire Email Marketer (IEM) prior to 6.1.6 allows remote attackers to byp…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Interspire Email Marketer < 6.1.6 - Remote Admin Authentication Bypass2018-04-24 · webapps · php
Impact
The function in charge to check whether the user is already logged in init.php in Interspire Email Marketer (IEM) prior to 6.1.6 allows remote attackers to bypass authentication and obtain administrative access by using the IEM_CookieLogin cookie with a specially crafted value.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Interspire | Email Marketer | through 6.1.5 |
Weakness classification
References
- NVD record
- CVE.org record
- http://seclists.org/fulldisclosure/2017/Oct/39
- https://security.infoteam.ch/en/blog/posts/narrative-of-an-incident-response-from-compromise-to-the-publication-of-the-weakness.html
- https://www.exploit-db.com/exploits/44513/
- http://seclists.org/fulldisclosure/2017/Oct/39
- https://security.infoteam.ch/en/blog/posts/narrative-of-an-incident-response-from-compromise-to-the-publication-of-the-weakness.html
- https://www.exploit-db.com/exploits/44513/