CVE-2007-3494 Missing authorization in n/a

Medium 6.8 Published 29 Jun 2007 Updated 7 Aug 2024

Authenticated users can bypass privilege checks to read the database and modify plugins in Papoo CMS.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2007-3494?

CVE-2007-3494 is a medium-severity missing authorization vulnerability in n/a, published on 29 Jun 2007. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Papoo CMS 3.6, and possibly earlier, does not verify user privileges when accessing the backend administration plugins, which allows remote authenticated users to (1) read the entire database by accessing the database backup plugin via a devtools/templates/newdump_backend.html argument in the template parameter to interna/plugin.php, (2) create plugins, (3) remove plugins, (4) enable debug mode, and have other unspecified impact.

Which versions are affected by CVE-2007-3494?

It affects 1 product.

Products include Papoo Papoo.

How do I fix CVE-2007-3494?

No fix has been published for CVE-2007-3494 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2007-3494 being exploited?

There is no known exploitation of CVE-2007-3494 in the wild and no public exploit code.

Sources

Also known as GHSA-hw45-72c5-h6pw.