CVE-2008-3509

EUVD-2008-3495
LoveCMS 1.6.2 does not require administrative authentication for (1) addblock.php, (2) blocks.php, and (3) themes.php in system/admin/, which allows remote attackers to change the configuration or execute arbitrary PHP code via addition of blocks, and other vectors.
Code Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:P/I:P/A:P
Base Score
CVSS 3.x
EPSS Score
Percentile: 94%
Affected Products (NVD)
VendorProductVersion
lovecmslovecms
1.6.2
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://secunia.com/advisories/31389
http://www.securityfocus.com/bid/30562
https://exchange.xforce.ibmcloud.com/vulnerabilities/44226
https://exchange.xforce.ibmcloud.com/vulnerabilities/44227
https://www.exploit-db.com/exploits/6209
https://www.exploit-db.com/exploits/6210
http://secunia.com/advisories/31389
http://www.securityfocus.com/bid/30562
https://exchange.xforce.ibmcloud.com/vulnerabilities/44226
https://exchange.xforce.ibmcloud.com/vulnerabilities/44227
https://www.exploit-db.com/exploits/6209
https://www.exploit-db.com/exploits/6210