Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
Serendipity Permissions Privileges and Access Controls Vulnerability - CVE-2010-1916 - Vulnerability Database
Serendipity

Serendipity Permissions Privileges and Access Controls Vulnerability - CVE-2010-1916

High
Reference: CVE-2010-1916
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2010-1916
Title: Serendipity Permissions Privileges and Access Controls Vulnerability
Overview:

The dynamic configuration feature in Xinha WYSIWYG editor 0.96 Beta 2 and earlier as used in Serendipity 1.5.2 and earlier allows remote attackers to bypass intended access restrictions and modify the configuration of arbitrary plugins via (1) crafted backend_config_secret_key_location and backend_config_hash parameters that are used in a SHA1 hash of a shared secret that can be known or externally influenced which are not properly handled by the quotDeprecated config passingquot feature or (2) crafted backend_data and backend_datakey_location variables which are not properly handled by the xinha_read_passed_data function. NOTE: this can be leveraged to upload and possibly execute arbitrary files via config.inc.php in the ImageManager plugin.