CVE-2008-6643

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2009-04-07 · updated 2026-06-16
Weakness: CWE-264

Description

LokiCMS 0.3.4 and possibly earlier versions does not properly restrict access to administrative functions, which allows remote attackers to bypass intended restrictions and modify configuration settings via the LokiACTION parameter in a direct request to admin.php.

Affected products

Lokicms: 0.3.4

References

http://osvdb.org/45866
http://www.securityfocus.com/archive/1/492877/100/0/threaded
http://www.securityfocus.com/bid/29448
https://exchange.xforce.ibmcloud.com/vulnerabilities/42766
http://osvdb.org/45866
http://www.securityfocus.com/archive/1/492877/100/0/threaded
http://www.securityfocus.com/bid/29448
https://exchange.xforce.ibmcloud.com/vulnerabilities/42766

Get alerted when CVE-2008-6643 or the next vulnerability affects your stack