Auth bypass in Creloaded Cre Loaded

CVE-2009-5077

CRE Loaded before 6.2.14 allows remote attackers to bypass authentication and gain administrator privileges via vectors related to a modified PHP_SELF variable, which is not properly handled by (1) includes/application_top.php and (2) admin/includes/application_top.php.

Vulnerability class: Broken Authentication

EPSS: 0.015 (71.4th percentile) — read the EPSS interpretation.

Affected products

Creloaded Cre_loaded — versions 6.15
N/a — versions n/a

Weakness classification (CWE)

CWE-287 — Improper Authentication

References

cve@mitre.org (URL Repurposed, Exploit, x_refsource_MISC)