CVE-2007-4338 index.php in Ryan Haudenschilt Family Connections (FCMS) before 0.9 allows remote attackers to access an arbitrary account by placing the account's name in the value of an fcms_login_id cookie. NOTE:....
HighCVSS 10.0
EPSS 8.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
index.php in Ryan Haudenschilt Family Connections (FCMS) before 0.9 allows remote attackers to access an arbitrary account by placing the account's name in the value of an fcms_login_id cookie. NOTE: this can be leveraged for code execution via a POST with PHP code in the content parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| haudenschilt family connections cms | <= 0.8 | No fix listed |
| haudenschilt family connections cms | = 0.1.1 | No fix listed |
| haudenschilt family connections cms | = 0.1.2 | No fix listed |
| haudenschilt family connections cms | = 0.5 | No fix listed |
| haudenschilt family connections cms | = 0.6 | No fix listed |
References
- 39534 vdb-entry
- 26421 third-party-advisory vendor-advisory
- 3009 third-party-advisory
- sourceforge.net
- 20070814 uncertain: FCMS (Family Connections) code execution mailing-list
- 20070823 vendor ACK for CVE-2007-4338 (Familr Connections) mailing-list
- 20070811 FCMS (Family Connections) <= 0.1.1 Remote Command Execution Exploit // www.MefistoLabs.com mailing-list
- 20070813 Re: FCMS (Family Connections) <= 0.1.1 Remote Command Execution Exploit // www.MefistoLabs.com mailing-list
- 25276 exploit vdb-entry
- family-fcmsloginid-security-bypass(35966) vdb-entry