VULNERABILITY INTELLIGENCE

CVE-2008-1971

CVSS score7.5 HIGH
EPSS probability2.21%
CISA KEVNot currently listed
Published2008-04-27
Last modified2026-06-16
CVSS vectorAV:N/AC:L/Au:N/C:P/I:P/A:P

Description

phShoutBox Final 1.5 and earlier only checks passwords when specified in $_POST, which allows remote attackers to gain privileges by setting the (1) phadmin cookie to admin.php, or (2) in 1.4 and earlier, the ssbadmin cookie to shoutadmin.php.

Weakness classification

  • CWE-287: Improper Authentication

Primary references