CVE-2007-3587

EPSS 2.9%

MyCMS 0.9.8 and earlier allows remote attackers to gain privileges via the admin cookie parameter, as demonstrated by a post to admin/settings.php that injects PHP code into settings.inc, which can then be executed via a direct request to index.php.

Affected products

n/a · n/a

public PoCs found — 1

cve_referencewww.exploit-db.com/exploits/4145unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://osvdb.org/45779 https://exchange.xforce.ibmcloud.com/vulnerabilities/35254 https://www.exploit-db.com/exploits/4145 http://www.securityfocus.com/archive/1/484064/100/100/threaded http://www.securityfocus.com/archive/1/484111/100/100/threaded http://www.securityfocus.com/bid/24757