CVE-2018-19437
UCMS 1.4.7 allows remote authenticated users to change the administrator password because $_COOKIE['admin_'.cookiehash] is used for arbitrary cookie values that are set and not empty.
- Score
- CVSS 3.0 8.8 High
- Status
- Modified - cve@mitre.org
- Published
- 2018-11-22
- Last modified
- 2024-08-05
Affected products
References
- https://github.com/wwwws1234/ucms/blob/master/Vertical%20crossing%20power.md
