Code injection

2007-01-1623:28:00

PRIOn knowledge base

www.prio-n.com

7.8 High

AI Score

Confidence

Low

0.054 Low

EPSS

Percentile

93.2%

JSON

snews.php in sNews 1.5.30 and earlier does not properly exit when authentication fails, which allows remote attackers to perform unauthorized administrative actions, as demonstrated by changing an administrative password via the changeup task, and by uploading PHP code via the imagefile parameter.

CPENameOperatorVersion
snewseq1.5.29
snewseq1.5.30

CPE	Name	Operator	Version
	snews	eq	1.5.29
	snews	eq	1.5.30

References

osvdb.org/32817

secunia.com/advisories/23746

www.securityfocus.com/bid/22025

exchange.xforce.ibmcloud.com/vulnerabilities/31535

www.exploit-db.com/exploits/3116