CVE-2008-6291
published 2009-02-26CVE-2008-6291: Acc PHP eMail 1.1 allows remote attackers to bypass authentication and gain administrative access by setting the NEWSLETTERLOGIN cookie to "admin".
PriorityP352high7.5CVSS 2.0
AVNACLAuNCPIPAP
EXPLOIT
EPSS
2.45%
82.4th percentile
Acc PHP eMail 1.1 allows remote attackers to bypass authentication and gain administrative access by setting the NEWSLETTERLOGIN cookie to "admin".
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| accscripts | acc_php_email | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No writeups or analysis indexed.
CWE
Reliance on Untrusted Inputs in a Security Decision
mitre_cwe
CWE-807 Reliance on Untrusted Inputs in a Security Decision
CWE-807: Reliance on Untrusted Inputs in a Security Decision
The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.
Developers may assume that inputs such as cookies, environment variables, and hidden form fields cannot be modified. However, an attacker could change these inputs using customized clients or other attacks. This change might not be detected. When security decisions such as authentication and authorization are made based on the values of these inputs, attackers can bypass the security of the software. Without sufficient encryption, integrity checking, or other mechanism, any input that originates from an outsider cannot be trusted.
Modes
CWE
Reliance on Cookies without Validation and Integrity Checking in a Security Decision
mitre_cwe
CWE-784 Reliance on Cookies without Validation and Integrity Checking in a Security Decision
CWE-784: Reliance on Cookies without Validation and Integrity Checking in a Security Decision
The product uses a protection mechanism that relies on the existence or values of a cookie, but it does not properly ensure that the cookie is valid for the associated user.
Attackers can easily modify cookies, within the browser or by implementing the client-side code outside of the browser. Attackers can bypass protection mechanisms such as authorization and authentication by modifying the cookie to contain an expected value.
Modes of Introduction:
Phase: Implementation
Common Consequences:
Scope: Access Control. Impact: Bypass Protection Mechanism, Gain Privileges or Assume Identity. It is dangerous to use cookies to set a user's privileges. The cookie can be manipulated to claim a high lev
http://secunia.com/advisories/32507http://www.securityfocus.com/bid/32074https://exchange.xforce.ibmcloud.com/vulnerabilities/46289https://www.exploit-db.com/exploits/6966http://secunia.com/advisories/32507http://www.securityfocus.com/bid/32074https://exchange.xforce.ibmcloud.com/vulnerabilities/46289https://www.exploit-db.com/exploits/6966
2009-02-26
Published