Design/Logic Flaw

2009-12-0717:30:00

PRIOn knowledge base

www.prio-n.com

7.4 High

AI Score

Confidence

Low

0.012 Low

EPSS

Percentile

85.0%

JSON

phpBazar 2.1.1fix and earlier does not require administrative authentication for admin/admin.php, which allows remote attackers to obtain access to the admin control panel via a direct request.

CPENameOperatorVersion
phpbazareq2.1.0
phpbazareq2.1.1-fix
phpbazarle2.1.1
phpbazareq2.0.2

Name	Operator	Version
phpbazar	eq	2.1.0
phpbazar	eq	2.1.1-fix
phpbazar	le	2.1.1
phpbazar	eq	2.0.2

References

packetstormsecurity.org/0911-exploits/phpbazar-access.txt

www.securityfocus.com/bid/37132