CVE-2009-5076
CRE Loaded before 6.2.14, and possibly other versions before 6.3.x, allows remote attackers to bypass authentication and gain administrator...
Basic Information
- CVE State
- PUBLISHED
- Reserved Date
- June 07, 2011
- Published Date
- June 08, 2011
- Last Updated
- September 16, 2024
- Vendor
- CRE Loaded
- Product
- CRE Loaded
- Description
- CRE Loaded before 6.2.14, and possibly other versions before 6.3.x, allows remote attackers to bypass authentication and gain administrator privileges via a request with (1) login.php or (2) password_forgotten.php appended as the PATH_INFO, which bypasses a check that uses PHP_SELF, which is not properly handled by (a) includes/application_top.php and (b) admin/includes/application_top.php, as exploited in the wild in 2009.
- Tags
- Exploited in the Wild
- Yes (2011-06-08 10:00:00 UTC) Source
php
CVSS Scores
CVSS v2.0
7.5
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Exploit Status
References
Known Exploited Vulnerability Information
| Source | Added Date |
|---|---|
| CVE | 2011-06-08 10:00:00 UTC |
Timeline
-
CVE ID Reserved
-
CVE Published to Public
-
Added to KEVIntel