CVE-2008-2879

Benja CMS 0.1 is affected by an authentication bypass vulnerability: remote attackers can access the admin/ area without credentials and add or delete a menu. The issue is that admin access does not require authentication, enabling modification of menu items. Root cause is insufficient access con...

CVE-2008-2988

Benja CMS 0.1 contains an unrestricted file upload vulnerability in admin/upload.php. The issue lets remote attackers upload and execute arbitrary PHP files by unspecified vectors, followed by directly requesting the uploaded file in billeder/. Root cause is an improper validation of uploaded con...

CVE-2008-2987

CVE-2008-2987 describes multiple cross-site scripting (XSS) vulnerabilities in Benja CMS 0.1. The issue is triggered by PATH_INFO input to the admin subsystem, specifically the files admin_edit_submenu.php, admin_new_submenu.php, and admin_edit_topmenu.php, allowing remote attackers to inject arb...