CVE-2010-1097 - include/userlogin.class.php in DeDeCMS 5.5 GBK, when session.auto_start is enabled, allows remote attackers to bypass authentication and gain administrative access via a value of 1 for the _SESSION[dede_admin_id] parameter, as demonstrated by a request to uploads/include/dialog/select_soft_post.php

Back Back to CVE browser

MEDIUM

include/userlogin.class.php in DeDeCMS 5.5 GBK, when session.auto_start is enabled, allows remote attackers to bypass authentication and gain administrative access via a value of 1 for the _SESSION[dede_admin_id] parameter, as demonstrated by a request to uploads/include/dialog/select_soft_post.php

Published Mar 24, 2010

6.8

MEDIUM

CVSS 2.0

EPSS 1.38%

Description

include/userlogin.class.php in DeDeCMS 5.5 GBK, when session.auto_start is enabled, allows remote attackers to bypass authentication and gain administrative access via a value of 1 for the _SESSION[dede_admin_id] parameter, as demonstrated by a request to uploads/include/dialog/select_soft_post.php.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-287

Improper Authentication

References (5)

http://bbs.wolvez.org/topic/125/
x_refsource_MISCExploit
http://osvdb.org/62622
vdb-entryx_refsource_OSVDB
http://secunia.com/advisories/38790
third-party-advisoryx_refsource_SECUNIAVendor Advisory
http://www.securityfocus.com/bid/38469
vdb-entryx_refsource_BIDExploit
https://euvd.enisa.europa.eu/vulnerability/EUVD-2010-1129
Advisory

Link	Providers	Tags
http://bbs.wolvez.org/topic/125/		x_refsource_MISCExploit
http://osvdb.org/62622		vdb-entryx_refsource_OSVDB
http://secunia.com/advisories/38790		third-party-advisoryx_refsource_SECUNIAVendor Advisory
http://www.securityfocus.com/bid/38469		vdb-entryx_refsource_BIDExploit
https://euvd.enisa.europa.eu/vulnerability/EUVD-2010-1129		Advisory