CVE-2013-7137

The "remember me" functionality in login.php in Burden before 1.8.1 allows remote attackers to bypass authentication and gain privileges by setting the burden_user_rememberme cookie to 1.

• CWE-287

• http://www.exploit-db.com/exploits/30916Exploit, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/archive/1/530703/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
• https://github.com/joshf/Burden/commit/edaa1bb8f73d6f3c8b2e78b67f1b40e02fccd0c1Patch, Third Party Advisory
• https://github.com/joshf/Burden/issues/2Issue Tracking, Patch, Third Party Advisory
• https://github.com/joshf/Burden/releases/tag/1.8.1Release Notes, Third Party Advisory
• https://www.htbridge.com/advisory/HTB23192Broken Link
• http://www.exploit-db.com/exploits/30916Exploit, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/archive/1/530703/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
• https://github.com/joshf/Burden/commit/edaa1bb8f73d6f3c8b2e78b67f1b40e02fccd0c1Patch, Third Party Advisory
• https://github.com/joshf/Burden/issues/2Issue Tracking, Patch, Third Party Advisory
• https://github.com/joshf/Burden/releases/tag/1.8.1Release Notes, Third Party Advisory
• https://www.htbridge.com/advisory/HTB23192Broken Link

Published

Jan 26, 2014

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2013-7128Valve Bug Reporter in the valve-bugreporter package 2.10+bso…
• CVE-2013-7129Cross-site scripting (XSS) vulnerability in ThemeBeans Blooo…
• CVE-2013-7130The i_create_images_and_backing (aka create_images_and_backi…
• CVE-2013-7134Juvia uses the same secret key for all installations, which …
• CVE-2013-7135The Proc::Daemon module 0.14 for Perl uses world-writable pe…
• CVE-2013-7136The UPC Ireland Cisco EPC 2425 router (aka Horizon Box) does…
• CVE-2013-7138Directory traversal vulnerability in lib/functions/d-load.ph…
• CVE-2013-7139SQL injection vulnerability in download.php in Horizon Quick…
• CVE-2013-7140XML External Entity (XXE) vulnerability in the CalDAV interf…
• CVE-2013-7141Cross-site scripting (XSS) vulnerability in Open-Xchange (OX…
• CVE-2013-7142Cross-site scripting (XSS) vulnerability in Open-Xchange (OX…
• CVE-2013-7143Cross-site scripting (XSS) vulnerability in Open-Xchange (OX…