CVE-2017-14322: The function in charge to check whether the user is already logged in init.

The function in charge to check whether the user is already logged in init.php in Interspire Email Marketer (IEM) prior to 6.1.6 allows remote attackers to bypass authentication an

Status

Published

2017-10-18

Updated

2024-08-05

Assigning organization

mitre

Description

The function in charge to check whether the user is already logged in init.php in Interspire Email Marketer (IEM) prior to 6.1.6 allows remote attackers to bypass authentication and obtain administrative access by using the IEM_CookieLogin cookie with a specially crafted value.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

n/a n/a

n/aaffected

References

https://www.exploit-db.com/exploits/44513/ ↗
http://seclists.org/fulldisclosure/2017/Oct/39 ↗
https://security.infoteam.ch/en/blog/posts/narrative-of-an-incident-response-from-compromise-to-the-publication-of-the-weakness.html ↗