CVE-2007-3611 admin.php in VRNews 1.1.1, and possibly other 1.x versions, does not require authentication, which allows remote attackers to perform certain administrative actions via a direct request with a (1) edi...
HighCVSS 9.3
EPSS 3.3%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
admin.php in VRNews 1.1.1, and possibly other 1.x versions, does not require authentication, which allows remote attackers to perform certain administrative actions via a direct request with a (1) edit, (2) add, (3) config, or (4) del value in the act parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| vrnews | = 1.1.1 | No fix listed |
References
- 45787 vdb-entry
- vrnews-admin-security-bypass(35271) vdb-entry
- 4150 exploit