CVE-2007-4338
Last modified
CVE-2007-4338 is a vulnerability of currently unknown severity. index.php in Ryan Haudenschilt Family Connections (FCMS) before 0.9 allows remote attackers to access an arbitrary account by placing the account's name in the value of an fcms_login_id cookie. NOTE: this can be leveraged for code execution via a POST with PHP code in the content parameter.. EPSS estimates a 8.92% chance of exploitation in the next 30 days.
Description
index.php in Ryan Haudenschilt Family Connections (FCMS) before 0.9 allows remote attackers to access an arbitrary account by placing the account's name in the value of an fcms_login_id cookie. NOTE: this can be leveraged for code execution via a POST with PHP code in the content parameter.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Haudenschilt | Family Connections Cms | <= 0.8 |
| Haudenschilt | Family Connections Cms | 0.1.1 |
| Haudenschilt | Family Connections Cms | 0.1.2 |
| Haudenschilt | Family Connections Cms | 0.5 |
| Haudenschilt | Family Connections Cms | 0.6 |
References
- http://secunia.com/advisories/26421Vendor Advisory
- http://secunia.com/advisories/26421Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2007-4338?
How severe is CVE-2007-4338?
How do I fix CVE-2007-4338?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2007
- CVE-2007-4332SQL injection vulnerability in article.php in Article Dashbo…
- CVE-2007-4333Multiple cross-site scripting (XSS) vulnerabilities in signu…
- CVE-2007-4334Cross-site scripting (XSS) vulnerability in whois.php in Php…
- CVE-2007-4335Format string vulnerability in the SMTP server component in …
- CVE-2007-4336Buffer overflow in the Live Picture Corporation DXSurface.Li…
- CVE-2007-4337Multiple buffer overflows in the httplib_parse_sc_header fun…
- CVE-2007-4339Multiple PHP remote file inclusion vulnerabilities in PHPCen…
- CVE-2007-4340PHP remote file inclusion vulnerability in index.php in phpD…
- CVE-2007-4341PHP remote file inclusion vulnerability in adm/my_statistics…
- CVE-2007-4342PHP remote file inclusion vulnerability in include.php in PH…
- CVE-2007-4343Stack-based buffer overflow in IrfanView 3.99 and 4.00 allow…
- CVE-2007-4344Multiple input validation errors in ACD ACDSee Photo Manager…
Are you affected by CVE-2007-4338?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST