Mevin Productions Basic PHP Events Lister 2.0 does not properly restrict access to (1) admin/reset.php and (2) admin/user_add.php, which allows remote authenticated users to reset administrative passwords or add administrators via a direct request.

Threat-Mapped Scoring

Score: 0.0

Priority: Unclassified

EPSS

Score: 0.00899
Percentile: 0.74674

CVSS Scoring

Mapped CWE(s)

• CWE-862 : Missing Authorization

All CAPEC(s)

CAPEC(s) with Mapped TTPs

Mapped ATT&CK TTPs

• T1211 : Exploitation for Defense Evasion
  Kill Chain: defense-evasion
• T1542.002 : Component Firmware
  Kill Chain: persistence
• T1556 : Modify Authentication Process
  Kill Chain: credential-access

Malware

APTs Threat Group Associations

Campaigns

Affected Products

• cpe:2.3:a:mevin:basic_php_events_lister:2.0:*:*:*:*:*:*:*

← Back to Home