CVE-2009-2025

critical

Description

admin/login.php in DM FileManager 3.9.2 allows remote attackers to bypass authentication and gain administrative access by setting the (1) USER, (2) GROUPID, (3) GROUP, and (4) USERID cookies to certain values.

References

https://www.exploit-db.com/exploits/8903

http://www.vupen.com/english/advisories/2009/1532

http://secunia.com/advisories/35167

Details

Source: Mitre, NVD

Published: 2009-06-09

Updated: 2026-06-16

Risk Information

CVSS v2

Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Severity: High

CVSS v3

Base Score: 9.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: Critical

EPSS

EPSS: 0.01767

Detections

Analytics