Vulnerability Details CVE-2009-5076
CRE Loaded before 6.2.14, and possibly other versions before 6.3.x, allows remote attackers to bypass authentication and gain administrator privileges via a request with (1) login.php or (2) password_forgotten.php appended as the PATH_INFO, which bypasses a check that uses PHP_SELF, which is not properly handled by (a) includes/application_top.php and (b) admin/includes/application_top.php, as exploited in the wild in 2009.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 45.5%
CVSS Severity
CVSS v2 Score 7.5
References
Products affected by CVE-2009-5076
-
cpe:2.3:a:creloaded:cre_loaded:*
-
cpe:2.3:a:creloaded:cre_loaded:6.15
-
cpe:2.3:a:creloaded:cre_loaded:6.3