Unscored severity · published May 22, 2009
CVE-2009-1771
index.php in Flyspeck CMS 6.8 does not require administrative authentication for the updateExistingContent action, which allows remote attackers to create or modify admin accounts…
–
CVSS
2.5%
EPSS
No
On KEV
Description
index.php in Flyspeck CMS 6.8 does not require administrative authentication for the updateExistingContent action, which allows remote attackers to create or modify admin accounts via the (1) users[fullname], (2) users[email], (3) users[role_id], (4) users[username], and (5) users[password] parameters.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.5% · higher than 84% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FC
Flyspeck Cms · Flyspeck
6.8 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-1771
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-1771
Exploit
http://www.securityfocus.com/bid/35011
www.vupen.com
http://www.vupen.com/english/advisories/2009/1367
www.exploit-db.com
https://www.exploit-db.com/exploits/8714
More from Flyspeck Cms
–
CVE-2009-1770
Directory traversal vulnerability in includes/database/examples/addressbook.php in Flyspeck CMS 6.8 allows remote attackers to include and execute arbitrary local files via a