CVE-2008-6664

Description

action.php in SH-News 3.0 allows remote attackers to bypass authentication and gain administrator privileges by setting the shuser and shpass cookies to non-zero values.

Affected Platforms

Weakness Type

CWE-287

References

• http://www.securityfocus.com/bid/29725
• http://www.shnews.de/change-log
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43123
• https://www.exploit-db.com/exploits/5829
• http://www.securityfocus.com/bid/29725
• http://www.shnews.de/change-log