vendor:
Acc PHP eMail
by:
Hakxer
7.5
CVSS
HIGH
Insecure Cookie Handling
200
CWE
Product Name: Acc PHP eMail
Affected Version From: v1.1
Affected Version To: v1.1
Patch Exists: NO
Related CWE: N/A
CPE: a:accscripts:acc_php_email
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2008
Acc PHP eMail v1.1 Insecure Cookie Handling
Acc PHP eMail v1.1 is vulnerable to insecure cookie handling. An attacker can inject arbitrary cookies into the application and gain access to the admin panel. The attacker can inject the cookie NEWSLETTERLOGIN=admin and gain access to the admin panel.
Mitigation:
The application should validate the cookie values before using them.
