CVE-2005-3010

Direct static code injection vulnerability in the flood protection feature in inc/shows.inc.php in CuteNews 1.4.0 and earlier allows remote attackers to execute arbitrary PHP code via the HTTP_CLIENT_IP header (Client-Ip), which is injected into data/flood.db.php.

Affected products

Cutenews

Cutephp Cutenews

≤ 1.4.0

Fix

Available

CVSS 2.0

7.5 HIGH

EPSS

6.3% (93th percentile)

NVD status

Modified

Published

2005-09-21