CVE-2009-5076 describes an authentication bypass vulnerability in CRE Loaded versions prior to 6.2.14, and potentially other 6.x versions, that allowed remote attackers to gain administrator privileges. This was achieved by appending "login.php" or "password_forgotten.php" to the PATH_INFO in a request, circumventing PHP_SELF checks in application_top.php files. With a CVSS score of 7.5, this vulnerability is considered highly severe due to its network-based attack vector, low complexity, and potential for full compromise of confidentiality, integrity, and availability. The vulnerability was exploited in the wild in 2009, although no public exploit code or Metasploit modules are currently available. Community discussion is minimal, with only one mention indicating its use in conjunction with other CVEs in a BlackHole Exploit Kit.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 6.2CPE matchmatch criteria | cpe:2.3:a:creloaded:cre_loaded:*:*:*:*:*:*:*:* | ||
6.3CPE matchmatch criteria | cpe:2.3:a:creloaded:cre_loaded:6.3:*:*:*:*:*:*:* | ||
6.15CPE matchmatch criteria | cpe:2.3:a:creloaded:cre_loaded:6.15:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:L/Au:N/C:P/I:P/A:P
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.