CVE-2008-1971

phShoutBox Final 1.5 and earlier only checks passwords when specified in $_POST, which allows remote attackers to gain privileges by setting the (1) phadmin cookie to admin.php, or (2) in 1.4 and earlier, the ssbadmin cookie to shoutadmin.php.

CVSS v2.0 NVD

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

2.21% chance of exploitation in the next 30 days, 82nd percentile

Published

2008-04-27

Updated

2024-08-07

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/5467

Security advisories

• http://secunia.com/advisories/29892
• http://www.securityfocus.com/bid/28856

References

• CVE Record
• NVD entry