CVE-2009-1771

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2009-05-22 · updated 2026-06-16
Weakness: CWE-264

Description

index.php in Flyspeck CMS 6.8 does not require administrative authentication for the updateExistingContent action, which allows remote attackers to create or modify admin accounts via the (1) users[fullname], (2) users[email], (3) users[role_id], (4) users[username], and (5) users[password] parameters.

Affected products

Flyspeck Cms: 6.8

References

http://www.securityfocus.com/bid/35011
http://www.vupen.com/english/advisories/2009/1367
https://www.exploit-db.com/exploits/8714
http://www.securityfocus.com/bid/35011
http://www.vupen.com/english/advisories/2009/1367
https://www.exploit-db.com/exploits/8714

Get alerted when CVE-2009-1771 or the next vulnerability affects your stack