Scorpio Framework 'baseAdminSite' Security Bypass Vulnerability

Bugtraq ID:	34702
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 03 2009 12:00AM
Updated:	Apr 27 2009 07:06PM
Credit:	The vendor
Vulnerable:	Scorpio Framework Scorpio Framework 0.1.4
Not Vulnerable:	Scorpio Framework Scorpio Framework 0.2

Scorpio Framework 'baseAdminSite' Security Bypass Vulnerability

Scorpio Framework is prone to a security-bypass vulnerability.

Attackers may exploit the issue to bypass certain security restrictions and carry out unauthorized actions.

Versions prior to Scorpio Framework 0.2.0 are vulnerable.

Scorpio Framework 'baseAdminSite' Security Bypass Vulnerability

Attackers can exploit this issue via a browser.

Scorpio Framework 'baseAdminSite' Security Bypass Vulnerability

Solution:
Vendor updates are available. Please see the references for details.


Scorpio Framework Scorpio Framework 0.1.4

• Scorpio Framework scorpioframework_php_0.2.0.tar.gz
  http://sourceforge.net/project/downloading.php?group_id=223130&filenam e=scorpioframework_php_0.2.0.tar.gz&a=91037159

Scorpio Framework 'baseAdminSite' Security Bypass Vulnerability

References:

• Release Name: 0.2.0-stable (Scorpio Framework)
  
• SCM Repositories - scorpiofwork Revision 228 (Scorpio Framework)
  
• Scorpio Framework Homepage (Scorpio Framework)