CVE-2008-7024

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2009-08-21 · updated 2026-06-16
Weakness: CWE-264

Description

admin.php in Arz Development The Gemini Portal 4.7 and earlier allows remote attackers to bypass authentication and gain administrator privileges by setting the user cookie to "admin" and setting the name parameter to "users."

Affected products

Arzdev Gemini Lite: 3.5, 3.6
Arzdev Gemini Portal: 4.7

References

http://osvdb.org/48639
http://secunia.com/advisories/32057
http://www.securityfocus.com/archive/1/496761/100/0/threaded
http://www.securityfocus.com/bid/31429
https://exchange.xforce.ibmcloud.com/vulnerabilities/45439
https://www.exploit-db.com/exploits/6584
http://osvdb.org/48639
http://secunia.com/advisories/32057
http://www.securityfocus.com/archive/1/496761/100/0/threaded
http://www.securityfocus.com/bid/31429
https://exchange.xforce.ibmcloud.com/vulnerabilities/45439
https://www.exploit-db.com/exploits/6584

Get alerted when CVE-2008-7024 or the next vulnerability affects your stack