CVE-2008-6643

EUVD-2008-6605
LokiCMS 0.3.4 and possibly earlier versions does not properly restrict access to administrative functions, which allows remote attackers to bypass intended restrictions and modify configuration settings via the LokiACTION parameter in a direct request to admin.php.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:N/I:P/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 80%
Affected Products (NVD)
VendorProductVersion
lokicmslokicms
0.3.4
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://osvdb.org/45866
http://www.securityfocus.com/archive/1/492877/100/0/threaded
http://www.securityfocus.com/bid/29448
https://exchange.xforce.ibmcloud.com/vulnerabilities/42766
http://osvdb.org/45866
http://www.securityfocus.com/archive/1/492877/100/0/threaded
http://www.securityfocus.com/bid/29448
https://exchange.xforce.ibmcloud.com/vulnerabilities/42766