vendor:
VRNews
by:
R4M!
5.5
CVSS
MEDIUM
/VRNews/admin.php Permission
CWE
Product Name: VRNews
Affected Version From: VRNews v1.x
Affected Version To: VRNews v1.x
Patch Exists: NO
Related CWE:
CPE:
Platforms Tested:
2007
VRNews v1.x <= /VRNews/admin.php Permission
The exploit allows unauthorized access to sensitive files and actions in the VRNews v1.x admin panel. It can be exploited by an attacker by directly accessing specific URLs in the admin.php file.
Mitigation:
To mitigate this vulnerability, it is recommended to upgrade to a newer version of VRNews that addresses this issue. Additionally, access to the admin.php file should be restricted to authorized personnel only.
