6.4med
CVE-2008-41671 exploit
useradmin.php in Easy Photo Gallery (aka Ezphotogallery) 2.1 does not require administrative authentication, which allows remote attackers…
Published 18 y ago · modified 4 mo ago · JSON
CVSS
6.4
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
2.6%
percentile 85%
Public exploits
1
Exploit-DB
Summary
useradmin.php in Easy Photo Gallery (aka Ezphotogallery) 2.1 does not require administrative authentication, which allows remote attackers to (1) add or (2) remove an Administrator account.
Exploit prediction (EPSS)
2.61% probability of exploitation in the next 30 days, higher than 85% of all scored CVEs.
Exploits and detections
- EDB-6437 Easy Photo Gallery 2.1 - Arbitrary Add Admin / remove user · webapps · 2008-09-11
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 2.0 | 6.4 | AV:N/AC:L/Au:N/C:N/I:P/A:P |
Classification
- Weakness
- CWE-287 Improper Authentication
References
- securityfocus.com /bid/31161 · vdb-entry, x_refsource_BID, x_transferred
- exploit-db.com /exploits/6437 · exploit, x_refsource_EXPLOIT-DB, x_transferred
- secunia.com /advisories/31774 · third-party-advisory, x_refsource_SECUNIA, x_transferred
- securityreason.com /securityalert/4282 · third-party-advisory, x_refsource_SREASON, x_transferred
- exchange.xforce.ibmcloud.com /vulnerabilities/45119 · vdb-entry, x_refsource_XF, x_transferred
Sources
- CVE List: CVE-2008-4167
- NVD: CVE-2008-4167
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.