CVE-2007-2233

EPSS 2.0%

cosign-bin/cosign.cgi in Cosign 2.0.2 and earlier allows remote authenticated users to perform unauthorized actions as an arbitrary user by using CR (\r) sequences in the service parameter to inject LOGIN and REGISTER commands with the desired username.

Affected products

n/a · n/a

public PoCs found — 1

exploitdbwww.exploit-db.com/exploits/29844unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://secunia.com/advisories/24845 http://www.securityfocus.com/archive/1/465386/100/100/threaded http://www.umich.edu/~umweb/software/cosign/cosign-vuln-2007-002.txt http://www.vupen.com/english/advisories/2007/1359