CVE-2007-2822 TutorialCMS 1.01 and earlier, when register_globals is enabled, allows remote attackers to bypass authentication via the (1) loggedIn and (2) activated parameters to (a) login.php, (b) headerLinks.php...
HighCVSS 9.3
EPSS 4.4%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
TutorialCMS 1.01 and earlier, when register_globals is enabled, allows remote attackers to bypass authentication via the (1) loggedIn and (2) activated parameters to (a) login.php, (b) headerLinks.php, (c) submit1.php, (d) myFav.php, and (e) userCP.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wavelink media tutorialcms | <= 1.01 | No fix listed |
References
- 36520 vdb-entry
- 25358 third-party-advisory vendor-advisory
- ADV-2007-1903 vdb-entry
- www.wavelinkmedia.com
- tutorialcms-multiple-security-bypass(34401) vdb-entry
- 3963 exploit