CVE-2002-0267 preferences.php in Simple Internet Publishing System (SIPS) before 0.3.1 allows remote attackers to gain administrative privileges via a linebreak in the "theme" field followed by the Status::admin co...
HighCVSS 10.0
EPSS 2.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
preferences.php in Simple Internet Publishing System (SIPS) before 0.3.1 allows remote attackers to gain administrative privileges via a linebreak in the "theme" field followed by the Status::admin command, which causes the Status line to be entered into the password file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sips | = 0.2.4 | No fix listed |
| sips | = 0.3.0 | No fix listed |
| sips | = 0.3.0pl1 | No fix listed |
| sips | = 0.3.0pl2 | No fix listed |
References
- 20020212 SIPS - vulnerable to anyone gaining admin access. mailing-list
- sips.sourceforge.net patch vendor-advisory
- sips-theme-admin-access(8193) vdb-entry
- 4097 vdb-entry