CVE-2007-3587 MyCMS 0.9.8 and earlier allows remote attackers to gain privileges via the admin cookie parameter, as demonstrated by a post to admin/settings.php that injects PHP code into settings.inc, which can th...
HighCVSS 7.5
EPSS 2.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
MyCMS 0.9.8 and earlier allows remote attackers to gain privileges via the admin cookie parameter, as demonstrated by a post to admin/settings.php that injects PHP code into settings.inc, which can then be executed via a direct request to index.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mycms | <= 0.9.8 | No fix listed |
References
- 45779 vdb-entry
- 20071122 MyBlog (MyCMS) Remote PHP Code execution / PHP Code injection .. mailing-list
- 20071123 Re: MyBlog (MyCMS) Remote PHP Code execution / PHP Code injection .. mailing-list
- 24757 exploit vdb-entry
- mycms-settings-games-command-execution(35254) vdb-entry
- 4145 exploit