CVEvulnerability

CVE-2007-0261

10.0 HIGH Published 2007-01-16 Modified 2026-06-16 Official page ↗

Status: Modified
Published: 2007-01-16
Last modified: 2026-06-16
Assigner: [email protected]
CVSS 2.0 ([email protected]): 10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C

Description

snews.php in sNews 1.5.30 and earlier does not properly exit when authentication fails, which allows remote attackers to perform unauthorized administrative actions, as demonstrated by changing an administrative password via the changeup task, and by uploading PHP code via the imagefile parameter.

Affected configurations

• snews snews 1.5.29 • snews snews 1.5.30

References

http://osvdb.org/32817 osvdb.org
http://secunia.com/advisories/23746 secunia.com
http://www.securityfocus.com/bid/22025 www.securityfocus.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/31535 exchange.xforce.ibmcloud.com
https://www.exploit-db.com/exploits/3116 www.exploit-db.com
http://osvdb.org/32817 osvdb.org
http://secunia.com/advisories/23746 secunia.com
http://www.securityfocus.com/bid/22025 www.securityfocus.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/31535 exchange.xforce.ibmcloud.com
https://www.exploit-db.com/exploits/3116 www.exploit-db.com