CVE-2008-7024 admin.php in Arz Development The Gemini Portal 4.7 and earlier allows remote attackers to bypass authentication and gain administrator privileges by setting the user cookie to "admin" and setting the....
MediumCVSS 6.8
EPSS 2.5%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
admin.php in Arz Development The Gemini Portal 4.7 and earlier allows remote attackers to bypass authentication and gain administrator privileges by setting the user cookie to "admin" and setting the name parameter to "users."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| arzdev gemini lite | = 3.5 | No fix listed |
| arzdev gemini lite | = 3.6 | No fix listed |
| arzdev gemini portal | = 4.7 | No fix listed |
References
- 48639 vdb-entry
- 32057 third-party-advisory vendor-advisory
- 20080926 The Gemini Portal <= 4.7 / Insecure Cookie Handling Vulnerability mailing-list
- 31429 exploit vdb-entry
- geminiportal-admin-security-bypass(45439) vdb-entry
- 6584 exploit