CVE-2010-1097
include/userlogin.class.php in DeDeCMS 5.5 GBK, when session.auto_start is enabled, allows remote attackers to bypass authentication and gain administrative access via a value of 1 for the _SESSION[dede_admin_id] parameter, as demonstrated by a request to uploads/include/dialog/select_soft_post.php.
- Score
- CVSS 2.0 6.8 Medium
- Status
- Modified - cve@mitre.org
- Published
- 2010-03-24
- Last modified
- 2024-09-17
- Weaknesses
- CWE-287
Affected products
References
- http://bbs.wolvez.org/topic/125/
- http://osvdb.org/62622
- http://secunia.com/advisories/38790
- http://www.securityfocus.com/bid/38469
