CVE-2008-6553

microcms-admin-home.php in Implied by Design Micro CMS (Micro-CMS) 3.5 (aka 0.3.5) does not require authentication as an administrator, which allows remote attackers to (1) create administrative accounts via an add_admin action, (2) remove administrative accounts via a delete_admin action, and (3) modify administrative passwords via a change_password action.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:P/I:P/A:P
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 82%
VendorProductVersion
impliedbydesignmicro-cms
𝑥
≤ 0.3.5
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://downloads.securityfocus.com/vulnerabilities/exploits/32063.pl
http://www.securityfocus.com/bid/32063
https://exchange.xforce.ibmcloud.com/vulnerabilities/46294
https://www.exploit-db.com/exploits/6933
http://downloads.securityfocus.com/vulnerabilities/exploits/32063.pl
http://www.securityfocus.com/bid/32063
https://exchange.xforce.ibmcloud.com/vulnerabilities/46294
https://www.exploit-db.com/exploits/6933