CVE-2009-1780 - admin.php in Frax.dk Php Recommend 1.3 and earlier does not require authentication when the user password is changed, which allows remote attackers to gain administrative privileges via modified form_admin_user and form_admin_pass parameters

Back Back to CVE browser

HIGH

admin.php in Frax.dk Php Recommend 1.3 and earlier does not require authentication when the user password is changed, which allows remote attackers to gain administrative privileges via modified form_admin_user and form_admin_pass parameters

Published May 22, 2009

7.5

HIGH

CVSS 2.0

EPSS 3.76%

Description

admin.php in Frax.dk Php Recommend 1.3 and earlier does not require authentication when the user password is changed, which allows remote attackers to gain administrative privileges via modified form_admin_user and form_admin_pass parameters.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-306

Missing Authentication

References (3)

http://www.securityfocus.com/bid/34909
vdb-entryx_refsource_BIDExploitThird Party AdvisoryVDB Entry
http://www.vupen.com/english/advisories/2009/1287
vdb-entryx_refsource_VUPENPermissions Required
https://www.exploit-db.com/exploits/8658
exploitx_refsource_EXPLOIT-DBThird Party AdvisoryVDB Entry

Link	Providers	Tags
http://www.securityfocus.com/bid/34909		vdb-entryx_refsource_BIDExploitThird Party AdvisoryVDB Entry
http://www.vupen.com/english/advisories/2009/1287		vdb-entryx_refsource_VUPENPermissions Required
https://www.exploit-db.com/exploits/8658		exploitx_refsource_EXPLOIT-DBThird Party AdvisoryVDB Entry

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published May 22, 2009

Updated Aug 7, 2024

Reserved May 22, 2009

Link CVE-2009-1780

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 16, 2026

Link CVE-2009-1780

Red Hat

Severity n/a

Public date n/a

Links CVE-2009-1780