VulnerabilityModified

CVE-2007-4338

index.php in Ryan Haudenschilt Family Connections (FCMS) before 0.9 allows remote attackers to access an arbitrary account by placing the account's name in the value of an fcms_login_id cookie.

HIGH 10.0EPSS 8.92%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (8.92%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

index.php in Ryan Haudenschilt Family Connections (FCMS) before 0.9 allows remote attackers to access an arbitrary account by placing the account's name in the value of an fcms_login_id cookie. NOTE: this can be leveraged for code execution via a POST with PHP code in the content parameter.

CVSS 2.0: 10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C
EPSS: 8.92% probability · 95th percentile
CISA KEV: Not listed
Weakness: CWE-264
Affected: haudenschilt/family connections cms
Source: cve@mitre.org

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.