CVE-2009-5077

CRE Loaded before 6.2.14 allows remote attackers to bypass authentication and gain administrator privileges via vectors related to a modified PHP_SELF variable, which is not properly handled by (1) includes/application_top.php and (2) admin/includes/application_top.php.

Score

CVSS 2.0 7.5 High

Status

Modified - cve@mitre.org

Published

2011-06-08

Last modified

2024-09-16

Weaknesses

CWE-287

Affected products

• Cre Loaded (Creloaded)

References

• http://hosting-4-creloaded.com/node/116