CVE-2013-7137

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The "remember me" functionality in login.php in Burden before 1.8.1 allows remote attackers to bypass authentication and gain privileges by setting the burden_user_rememberme cookie to 1.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.exploit-db.com/exploits/30916Exploit, Third Party Advisory, VDB Entry
http://www.securityfocus.com/archive/1/530703/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
https://github.com/joshf/Burden/commit/edaa1bb8f73d6f3c8b2e78b67f1b40e02fccd0c1Patch, Third Party Advisory
https://github.com/joshf/Burden/issues/2Issue Tracking, Patch, Third Party Advisory
https://github.com/joshf/Burden/releases/tag/1.8.1Release Notes, Third Party Advisory
https://www.htbridge.com/advisory/HTB23192Broken Link
http://www.exploit-db.com/exploits/30916Exploit, Third Party Advisory, VDB Entry
http://www.securityfocus.com/archive/1/530703/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
https://github.com/joshf/Burden/commit/edaa1bb8f73d6f3c8b2e78b67f1b40e02fccd0c1Patch, Third Party Advisory
https://github.com/joshf/Burden/issues/2Issue Tracking, Patch, Third Party Advisory
https://github.com/joshf/Burden/releases/tag/1.8.1Release Notes, Third Party Advisory
https://www.htbridge.com/advisory/HTB23192Broken Link

Timeline

Published: Jan 26, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-71385.0Directory traversal vulnerability in lib/functions/d-load.php in Horizon Quick Content Management System (QCMS) 4.0 and earlier allows remot CVE-2013-71397.5SQL injection vulnerability in download.php in Horizon Quick Content Management System (QCMS) 4.0 and earlier allows remote to execute arbit CVE-2013-71404.0XML External Entity (XXE) vulnerability in the CalDAV interface in Open-Xchange (OX) AppSuite 7.4.1 and earlier allows remote authenticated CVE-2013-71414.3Cross-site scripting (XSS) vulnerability in Open-Xchange (OX) AppSuite 7.4.1 and earlier allows remote attackers to inject arbitrary web scr CVE-2013-71424.3Cross-site scripting (XSS) vulnerability in Open-Xchange (OX) AppSuite 7.4.1 and earlier allows remote attackers to inject arbitrary web scr CVE-2013-71434.3Cross-site scripting (XSS) vulnerability in Open-Xchange (OX) AppSuite 7.4.1 allows remote attackers to inject arbitrary web script or HTML CVE-2013-71444.3LINE 3.2.1.83 and earlier on Windows and 3.2.1 and earlier on OS X does not verify X.509 certificates from SSL servers, which allows man-in-CVE-2013-71497.5SQL injection vulnerability in www/delivery/axmlrpc.php (aka the XML-RPC delivery invocation script) in Revive Adserver before 3.0.2, and Op CVE-2013-71719.8Slackware 14.0 and 14.1, and Slackware LLVM 3.0-i486-2 and 3.3-i486-2, contain world-writable permissions on the /tmp directory which could CVE-2013-71727.8Slackware 13.1, 13.37, 14.0 and 14.1 contain world-writable permissions on the iodbctest and iodbctestw programs within the libiodbc package CVE-2013-71739.8Belkin n750 routers have a buffer overflow.CVE-2013-71747.8Absolute path traversal vulnerability in cgi-bin/jc.cgi in QNAP QTS before 4.1.0 allows remote attackers to read arbitrary files via a full