National Cyber Awareness System

Vulnerability Summary for CVE-2007-4338

Overview

index.php in Ryan Haudenschilt Family Connections (FCMS) before 0.9 allows remote attackers to access an arbitrary account by placing the account's name in the value of an fcms_login_id cookie. NOTE: this can be leveraged for code execution via a POST with PHP code in the content parameter.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: XF

Name: family-fcmsloginid-security-bypass(35966)

Hyperlink:http://xforce.iss.net/xforce/xfdb/35966

External Source: BID

Name: 25276

Hyperlink:http://www.securityfocus.com/bid/25276

External Source: BUGTRAQ

Name: 20070813 Re: FCMS (Family Connections) <= 0.1.1 Remote Command Execution Exploit // www.MefistoLabs.com

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/476293/100/0/threaded

External Source: BUGTRAQ

Name: 20070811 FCMS (Family Connections) <= 0.1.1 Remote Command Execution Exploit // www.MefistoLabs.com

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/476142/100/0/threaded

External Source: VIM

Name: 20070823 vendor ACK for CVE-2007-4338 (Familr Connections)

Hyperlink:http://www.attrition.org/pipermail/vim/2007-August/001768.html

External Source: VIM

Name: 20070814 uncertain: FCMS (Family Connections) code execution

Hyperlink:http://www.attrition.org/pipermail/vim/2007-August/001762.html

External Source: CONFIRM

Name: http://sourceforge.net/tracker/index.php?func=detail&aid=1778696&group_id=189733&atid=930513

Hyperlink:http://sourceforge.net/tracker/index.php?func=detail&aid=1778696&group_id=189733&atid=930513

External Source: SREASON

Name: 3009

Hyperlink:http://securityreason.com/securityalert/3009

External Source: SECUNIA

Name: 26421

Type: Advisory

Hyperlink:http://secunia.com/advisories/26421

External Source: OSVDB

Name: 39534

Hyperlink:http://osvdb.org/39534