CVE-2008-6553 microcms-admin-home.php in Implied by Design Micro CMS (Micro-CMS) 3.5 (aka 0.3.5) does not require authentication as an administrator, which allows remote attackers to (1) create administrative accou...
HighCVSS 7.5
EPSS 2.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
microcms-admin-home.php in Implied by Design Micro CMS (Micro-CMS) 3.5 (aka 0.3.5) does not require authentication as an administrator, which allows remote attackers to (1) create administrative accounts via an add_admin action, (2) remove administrative accounts via a delete_admin action, and (3) modify administrative passwords via a change_password action.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| impliedbydesign micro-cms | <= 0.3.5 | No fix listed |
References
- downloads.securityfocus.com exploit
- 32063 exploit vdb-entry
- microcms-microcmsadminhome-security-bypass(46294) vdb-entry
- 6933 exploit