Unscored severity · published Nov 10, 2007
CVE-2007-5913
dirsys/modules/auth.php in JBC Explorer 7.20 RC1 and earlier does not require authentication, which allows remote attackers to (1) delete auth.inc.php via the suppr parameter, and…
–
CVSS
7.3%
EPSS
No
On KEV
Description
dirsys/modules/auth.php in JBC Explorer 7.20 RC1 and earlier does not require authentication, which allows remote attackers to (1) delete auth.inc.php via the suppr parameter, and (2) re-create the auth.inc.php file with contents that specify a new account name and password for JBC Explorer via the login and password parameters.
Exploitation
Is it being used?
Exploit prediction (EPSS)7.3% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JE
Jbc Explorer · Jean Charles
through 7.20_rc1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-5913
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-5913
mgsdl.free.fr
http://mgsdl.free.fr/?1:33
osvdb.org
http://osvdb.org/42069
Vendor Advisory
http://secunia.com/advisories/27533
securityreason.com
http://securityreason.com/securityalert/3358
www.securityfocus.com
http://www.securityfocus.com/archive/1/483268/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/bid/26332
More from Jbc Explorer
–
CVE-2007-5914
Direct static code injection vulnerability in dirsys/modules/config/post.php in JBC Explorer 7.20 RC1 and earlier allows remote authenticated administrators to inject arbitrary…