CVE-2018-16239

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An issue was discovered in damiCMS V6.0.1. It relies on the PHP time() function for cookies, which makes it possible to determine the cookie for an existing admin session via 10800 guesses.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-330

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/howchen/howchen/issues/2Exploit, Third Party Advisory
https://github.com/howchen/howchen/issues/2Exploit, Third Party Advisory

Timeline

Published: Aug 30, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-162425.3oBike relies on Hangzhou Luoping Smart Locker to lock bicycles, which allows attackers to bypass the locking mechanism by using Bluetooth Lo CVE-2018-162435.4SolarWinds Database Performance Analyzer (DPA) 11.1.468 and 12.0.3074 have several persistent XSS vulnerabilities, related to logViewer.iwc,CVE-2018-162475.4YzmCMS 5.1 has XSS via the admin/system_manage/user_config_add.html title parameter.CVE-2018-162486.1b3log Solo 2.9.3 has XSS in the Input page under the "Publish Articles" menu with an ID of "articleTags" stored in the "tag" JSON field, whi CVE-2018-162494.8In Symphony before 3.3.0, there is XSS in the Title under Post. The ID "articleTitle" of this is stored in the "articleTitle" JSON field, an CVE-2018-16254.3IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 generates an error message that includes sensitive information about its en CVE-2018-162505.4The "utilisateur" menu in Creatiwity wityCMS 0.6.2 modifies the presence of XSS at two input points for user information, with the "first na CVE-2018-162514.3A "search for user discovery" injection issue exists in Creatiwity wityCMS 0.6.2 via the "Utilisateur" menu. No input parameters are filtere CVE-2018-162523.3FsPro Labs Event Log Explorer 4.6.1.2115 has ".elx" FileType XML External Entity Injection.CVE-2018-162535.9In sig_verify() in x509.c in axTLS version 2.1.3 and before, the PKCS#1 v1.5 signature verification does not properly verify the ASN.1 metad CVE-2018-162546.1There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via action=options. NOTE: The vendor states that this is not a vul CVE-2018-162556.1There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via action=evaluate. NOTE: The vendor states that this is not a vu