CVE-2007-6496 Missing authorization in n/a

Medium 6.8 Published 20 Dec 2007 Updated 7 Aug 2024

Remote attackers can register arbitrary users without authentication by manipulating specific HTTP requests, leading to unauthorized access.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2007-6496?

CVE-2007-6496 is a medium-severity missing authorization vulnerability in n/a, published on 20 Dec 2007. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote attackers to register arbitrary users via a request to hosting/addsubsite.asp with the loginname and password parameters set, when preceded by certain requests to hosting/default.asp and hosting/selectdomain.asp, a related issue to CVE-2005-1654.

Weakness: CWE-264

Which versions are affected by CVE-2007-6496?

It affects 1 product.

Products include Hosting Controller Hosting Controller.

How do I fix CVE-2007-6496?

No fix has been published for CVE-2007-6496 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2007-6496 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2007-6496 exists.

Public exploit code: 1 Exploit-DB entry.

Sources

Also known as GHSA-r2qw-423m-96mg.