CVE-2009-1771

index.php in Flyspeck CMS 6.8 does not require administrative authentication for the updateExistingContent action, which allows remote attackers to create or modify admin accounts via the (1) users[fullname], (2) users[email], (3) users[role_id], (4) users[username], and (5) users[password] parameters.

CVSS v2.0

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

2.46% chance of exploitation in the next 30 days, 83th percentile

Published

2009-05-22

Updated

2024-08-07

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/8714

References

• CVE Record
• NVD entry

Related

• CVE-2009-1770
• CVE-2009-1774
• CVE-2009-1768
• CVE-2009-1776
• CVE-2009-1767
• CVE-2009-1777