Unscored severity · published Apr 27, 2008
CVE-2008-1971
phShoutBox Final 1.5 and earlier only checks passwords when specified in $_POST, which allows remote attackers to gain privileges by setting the (1) phadmin cookie to admin.php,…
–
CVSS
2.2%
EPSS
No
On KEV
Description
phShoutBox Final 1.5 and earlier only checks passwords when specified in $_POST, which allows remote attackers to gain privileges by setting the (1) phadmin cookie to admin.php, or (2) in 1.4 and earlier, the ssbadmin cookie to shoutadmin.php.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.2% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PF
Phshoutbox Final · Phphq
through 1.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-1971
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-1971
Vendor Advisory
http://secunia.com/advisories/29892
Exploit
http://www.securityfocus.com/bid/28856
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/41901
www.exploit-db.com
https://www.exploit-db.com/exploits/5467