cms.webspell.orgConfirmation
http://cms.webspell.org/index.php?site=files&file=15 CVE-2006-4782
webSPELL 4.01.01 - Database Backup Download
Record summary
CVE-2006-4782 has a selected CVSS score of 5.4; EIP currently links 1 catalogued exploit.
Description
src/index.php in WebSPELL 4.01.01 and earlier, when register_globals is enabled, allows remote attackers to bypass authentication and gain sensitive information stored in the database via a modified userID parameter in a write action to admin/database.php.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
Proofs of concept
1Catalogued exploits
ExploitDBwebSPELL 4.01.01 - Database Backup DownloadExploitDB exploitby TrexNot analyzed1 file
References
721881Third-party advisory
http://secunia.com/advisories/21881 19975vdb entry
http://www.securityfocus.com/bid/19975 ADV-2006-3572vdb entry
http://www.vupen.com/english/advisories/2006/3572 webspell-login-authentication-bypass(28896)vdb entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/28896 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2006-4782 2352exploit
https://www.exploit-db.com/exploits/2352