CVE-2009-3421

moderate-risk

Published 2009-09-25

login.php in Zenas PaoBacheca Guestbook 2.1, when register_globals is enabled, allows remote attackers to bypass authentication and gain administrative access by setting the login_ok parameter to 1.

Do I need to act?

1.6% chance of exploitation in next 30 days

EPSS score — moderate exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

1 public exploit available

9293

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 9.8/10 Critical

NETWORK / LOW complexity

Affected Products (1)

Pao-Bacheca Guestbook

Affected Vendors

Zenas

References (8)

Broken Link http://secunia.com/advisories/36023

Third Party Advisory http://www.exploit-db.com/exploits/9293

Broken Link http://www.osvdb.org/56757

Third Party Advisory https://exchange.xforce.ibmcloud.com/vulnerabilities/52100

Broken Link http://secunia.com/advisories/36023

Third Party Advisory http://www.exploit-db.com/exploits/9293

Broken Link http://www.osvdb.org/56757

Third Party Advisory https://exchange.xforce.ibmcloud.com/vulnerabilities/52100

/ 100

moderate-risk

Severity 32/34 · Critical

Exploitability 11/34 · Low

Exposure 5/34 · Minimal