CVE

Id
26851  
CVE No.
CVE-2007-3494  
Status
Candidate  
Description
Papoo CMS 3.6, and possibly earlier, does not verify user privileges when accessing the backend administration plugins, which allows remote authenticated users to (1) read the entire database by accessing the database backup plugin via a devtools/templates/newdump_backend.html argument in the template parameter to interna/plugin.php, (2) create plugins, (3) remove plugins, (4) enable debug mode, and have other unspecified impact.  
Phase
Assigned (20070629)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
273940 26851 CVE-2007-3494 BUGTRAQ:20070624 Papoo CMS 3.6 - Access Restriction Bypass  View
273941 26851 CVE-2007-3494 URL:http://www.securityfocus.com/archive/1/archive/1/472213/100/0/threaded  View
273942 26851 CVE-2007-3494 FULLDISC:20070624 Papoo CMS 3.6 - Access Restriction Bypass  View
273943 26851 CVE-2007-3494 URL:http://lists.grok.org.uk/pipermail/full-disclosure/2007-June/064171.html  View
273944 26851 CVE-2007-3494 MISC:http://www.papoo.de/index/menuid/204/reporeid/215  View
273945 26851 CVE-2007-3494 BID:24634  View
273946 26851 CVE-2007-3494 URL:http://www.securityfocus.com/bid/24634  View
273947 26851 CVE-2007-3494 OSVDB:37542  View
273948 26851 CVE-2007-3494 URL:http://osvdb.org/37542  View
273949 26851 CVE-2007-3494 SREASON:2853  View
273950 26851 CVE-2007-3494 URL:http://securityreason.com/securityalert/2853  View
273951 26851 CVE-2007-3494 XF:papoo-plugin-security-bypass(35032)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
57090 JVNDB-2007-005782 SAP NetWeaver Nw04 の BC-WD-JAV におけるクロスサイトスクリプティングの脆弱性 SAP NetWeaver Nw04 の SAP Web Dynpro Java (BC-WD-JAV) には、クロスサイトスクリプティングの脆弱性が存在します。 CVE-2007-3496 26851 4.3 http://jvndb.jvn.jp/ja/contents/2007/JVNDB-2007-005782.html  View