CVEvulnerability
CVE-2009-1780
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2009-05-22
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-306
Description
admin.php in Frax.dk Php Recommend 1.3 and earlier does not require authentication when the user password is changed, which allows remote attackers to gain administrative privileges via modified form_admin_user and form_admin_pass parameters.
Affected configurations
• frax php recommend (<= 1.3)
Related
Weakness · CWE (1)
- CWE-306 Missing Authentication for Critical Functionality weakness
References
- http://www.securityfocus.com/bid/34909 Exploit, Third Party Advisory, VDB Entry
- http://www.vupen.com/english/advisories/2009/1287 Permissions Required
- https://www.exploit-db.com/exploits/8658 Exploit, Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/34909 Exploit, Third Party Advisory, VDB Entry
- http://www.vupen.com/english/advisories/2009/1287 Permissions Required
- https://www.exploit-db.com/exploits/8658 Exploit, Third Party Advisory, VDB Entry