CVE-2009-2025

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

admin/login.php in DM FileManager 3.9.2 allows remote attackers to bypass authentication and gain administrative access by setting the (1) USER, (2) GROUPID, (3) GROUP, and (4) USERID cookies to certain values.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/35167Vendor Advisory
http://www.vupen.com/english/advisories/2009/1532Vendor Advisory
https://www.exploit-db.com/exploits/8903
http://secunia.com/advisories/35167Vendor Advisory
http://www.vupen.com/english/advisories/2009/1532Vendor Advisory
https://www.exploit-db.com/exploits/8903

Timeline

Published: Jun 9, 2009
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2009

CVE-2009-202610.0Stack-based buffer overflow in a token searching function in the dtscore library in Data Transport Services in CA Software Delivery r11.2 C1 CVE-2009-20277.2The Installer in Apple Safari before 4.0 on Windows allows local users to gain privileges by checking a box that specifies an immediate laun CVE-2009-202810.0Multiple unspecified vulnerabilities in Adobe Reader 7 and Acrobat 7 before 7.1.3, Adobe Reader 8 and Acrobat 8 before 8.1.6, and Adobe Read CVE-2009-20295.0Unspecified vulnerability in rpc.nisd in Sun Solaris 8 through 10, and OpenSolaris before snv_104, allows remote authenticated users to caus CVE-2009-203010.0Unspecified vulnerability in the XML Digital Signature verification functionality in JVA-RUN in JDK 6.0 in IBM OS/400 i5/OS V5R4M0 and V6R1M CVE-2009-20312.1smbfs in Sun OpenSolaris snv_84 through snv_110, when default mount permissions are used, allows local users to read arbitrary files, and li CVE-2009-20324.3Cross-site scripting (XSS) vulnerability in search.asp in PDshopPro, when downloaded before 20070308, allows remote attackers to inject arbi CVE-2009-20334.3Cross-site scripting (XSS) vulnerability in index.php in Yogurt 0.3 allows remote attackers to inject arbitrary web script or HTML via the m CVE-2009-20346.0SQL injection vulnerability in writemessage.php in Yogurt 0.3, when register_globals is enabled, allows remote authenticated users to execut CVE-2009-20356.4Unspecified vulnerability in Services 6.x before 6.x-0.14, a module for Drupal, when key-based access is enabled, allows remote attackers to CVE-2009-20367.5SQL injection vulnerability in index.php in Open Biller 0.1 allows remote attackers to execute arbitrary SQL commands via the username param CVE-2009-20376.8Multiple directory traversal vulnerabilities in Online Grades & Attendance 3.2.5 and earlier, and possibly 3.2.6, when register_globals is e