Critical severity · published Aug 30, 2018
CVE-2018-16239
An issue was discovered in damiCMS V6.0.1
9.8
CVSS
1.2%
EPSS
No
On KEV
Description
An issue was discovered in damiCMS V6.0.1. It relies on the PHP time() function for cookies, which makes it possible to determine the cookie for an existing admin session via 10800 guesses.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 69% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DA
Damicms · Damicms
6.0.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-16239
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-16239
Exploit
https://github.com/howchen/howchen/issues/2
More from Damicms
8.8
CVE-2020-21236
A vulnerability in /damicms-master/admin.php?s=/Article/doedit of DamiCMS v6.0 allows attackers to compromise and impersonate user accounts via obtaining a user's session cookie
8.8
CVE-2018-16331
admin.php?s=/Admin/doedit in DamiCMS v6.0.0 allows CSRF to change the administrator account's password
8.8
CVE-2018-15844
An issue was discovered in DamiCMS 6.0.0
8.8
CVE-2018-13031
DamiCMS v6.0.0 aand 6.1.0 allows CSRF via admin.php?s=/Admin/doadd to add an administrator account
8.0
CVE-2020-18458
Cross Site Request Forgery (CSRF) vulnerability exists in DamiCMS v6.0.6 that can add an admin account via admin.php?s=/Admin/doadd