by Kastro CVE-2024-1817
Demososo DM Enterprise Website Building System — Demososo DM Enterprise Website Building System Cookie indexDM_load.php dmlogin improper authentication
Description · from the CVE record
A vulnerability has been found in Demososo DM Enterprise Website Building System up to 2022.8 and classified as critical. Affected by this vulnerability is the function dmlogin of the file indexDM_load.php of the component Cookie Handler. The manipulation of the argument is_admin with the input y leads to improper authentication. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-254605 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Affected
ProductAffectedFixed inSource
DM Enterprise Website Building System2022.0–CNA
DM Enterprise Website Building System2022.1–CNA
DM Enterprise Website Building System2022.2–CNA
DM Enterprise Website Building System2022.3–CNA
DM Enterprise Website Building System2022.4–CNA
DM Enterprise Website Building System2022.5–CNA
DM Enterprise Website Building System2022.6–CNA
DM Enterprise Website Building System2022.7–CNA
DM Enterprise Website Building System2022.8–CNA
dm_enterprise_website_building_system2022.0 – 2022.8–CISA-ADP
Scores by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulDB (CNA)7.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
VulDB (CNA)7.3CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial