CVE-2008-6664 action.php in SH-News 3.0 allows remote attackers to bypass authentication and gain administrator privileges by setting the shuser and shpass cookies to non-zero values.
HighCVSS 7.5
EPSS 2.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
action.php in SH-News 3.0 allows remote attackers to bypass authentication and gain administrator privileges by setting the shuser and shpass cookies to non-zero values.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| yarck sh-news | = 3.0 | No fix listed |
References
- 29725 exploit vdb-entry
- www.shnews.de url-repurposed vendor-advisory
- shnews-action-authentication-bypass(43123) vdb-entry
- 5829 exploit