7.5high
CVE-2008-57081 exploit
redirect.php in SlimCMS 1.0.0 does not require authentication, which allows remote attackers to create administrative users by using the ne…
Published 17 y ago · modified 4 mo ago · JSON
CVSS
7.5
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
2.6%
percentile 86%
Public exploits
1
Exploit-DB
Summary
redirect.php in SlimCMS 1.0.0 does not require authentication, which allows remote attackers to create administrative users by using the newusername and newpassword parameters and setting the newisadmin parameter to 1.
Exploit prediction (EPSS)
2.64% probability of exploitation in the next 30 days, higher than 86% of all scored CVEs.
Exploits and detections
- EDB-6729 SlimCMS 1.0.0 - 'redirect.php' Privilege Escalation · webapps · 2008-10-10
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Classification
- Weakness
- CWE-287 Improper Authentication
References
- exchange.xforce.ibmcloud.com /vulnerabilities/45824 · vdb-entry, x_refsource_XF, x_transferred
- securityreason.com /securityalert/4804 · third-party-advisory, x_refsource_SREASON, x_transferred
- exploit-db.com /exploits/6729 · exploit, x_refsource_EXPLOIT-DB, x_transferred
- securityfocus.com /bid/31736 · vdb-entry, x_refsource_BID, x_transferred
Sources
- CVE List: CVE-2008-5708
- NVD: CVE-2008-5708
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.