JVN#74592196: bingo!CMS vulnerable to authentication bypass

bingo!CMS provided by Shift Tech Inc. contains an authentication bypass vulnerability (CWE-288) in some of the management functions.

Shift Tech Inc. states that attacks exploiting this vulnerability have been observed.

Impact

Accessing a specific URL directly may allow a remote unauthenticated attacker to upload an arbitrary file without authentication.
As a result, an arbitrary script may be executed and/or a file may be altered.

Solution

Update the software
Update the software to the latest version according to the information provided by the developer.
This vulnerability has been addressed in version 1.7.4.2.

Products Affected

• bingo!CMS version1.7.4.1 and earlier