Vulnerability CVE-2008-5708
Published: 2008-12-24   Modified: 2012-02-12

Description:
redirect.php in SlimCMS 1.0.0 does not require authentication, which allows remote attackers to create administrative users by using the newusername and newpassword parameters and setting the newisadmin parameter to 1.

See advisories in our WLB2 database:
Topic
Author
Date
High
SlimCMS <= 1.0.0 (redirect.php) Privilege Escalation Exploit
athos
25.12.2008

Type:

CWE-287

 (Improper Authentication)

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
7.5/10
6.4/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial
Affected software
Slimcms -> Slimcms 

 References:
http://xforce.iss.net/xforce/xfdb/45824
http://www.securityfocus.com/bid/31736
http://www.milw0rm.com/exploits/6729
http://securityreason.com/securityalert/4804
Copyright 2024, cxsecurity.com

 

Back to Top