CVE-2008-7124 zKup CMS 2.0 through 2.3 does not require administrative authentication for admin/configuration/modifier.php, which allows remote attackers to gain administrator privileges via a direct request, as de...
HighCVSS 7.5
EPSS 8.6%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
zKup CMS 2.0 through 2.3 does not require administrative authentication for admin/configuration/modifier.php, which allows remote attackers to gain administrator privileges via a direct request, as demonstrated by adding a new administrator.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| zkup | = 2.0 | No fix listed |
| zkup | = 2.01 | No fix listed |
| zkup | = 2.02 | No fix listed |
| zkup | = 2.03 | No fix listed |
References
- 43081 vdb-entry
- 29276 third-party-advisory vendor-advisory
- 28149 exploit vdb-entry
- www.zkup.fr patch
- zkup-modifier-authentication-bypass(41068) vdb-entry
- 5219 exploit
- 5220 exploit