Code injection

2007-04-3023:19:00

PRIOn knowledge base

www.prio-n.com

7.5 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

71.0%

JSON

admin/index.php in Gregory Kokanosky phpMyNewsletter 0.8 beta5 and earlier provides access to configuration modification before login, which allows remote attackers to cause a denial of service (loss of configuration data), and possibly perform direct static code injection, via a saveGlobalconfig action.

CPENameOperatorVersion
phpmynewslettereq<= 0.8beta5

CPE	Name	Operator	Version
	phpmynewsletter	eq	<= 0.8beta5

References

www.securityfocus.com/bid/23342

www.exploit-db.com/exploits/3671