Insecure Cookie Handling in Crux Gallery by Crux Gallery Technologies
CVE-2008-4484

Currently unrated

Key Information:

Vendor

Crux Software

Status
Gallery
Vendor
CVE Published:
8 October 2008

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2008-4484?

The Crux Gallery product version 1.32 and earlier is susceptible to a vulnerability that allows remote attackers to gain administrative access by manipulating the 'name' parameter within the 'main.php' file. This exploitation can occur via 'index.php', enabling unauthorized users to access privileged functionalities of the application through insecure cookie handling practices.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2008-4484 - Proof of Concept

References

http://www.securityfocus.com/archive/1/496763/100/0/threaded
mailing-listx_refsource_BUGTRAQ
https://exchange.xforce.ibmcloud.com/vulnerabilities/45443
vdb-entryx_refsource_XF
http://securityreason.com/securityalert/4365
third-party-advisoryx_refsource_SREASON

EPSS Score

9% chance of being exploited in the next 30 days.

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.