An attacker could upload a malicious script which would execute once the site was accessed, allowing them to steal user credentials or install malicious software.
An attacker could also gain access to other users’ profiles by gaining access to an administrator’s account.
The Cuppa CMS v1.0 installation does not enforce password expiration. Therefore, it is possible for an attacker to access a site after a certain period of time, if the user has not changed their password.
The Cuppa CMS v1.0 installation does not restrict the number of login attempts. Therefore, if an attacker were to obtain a user’s credentials, they would not be required to try very hard to access that account. An attacker could simply access that user’s account 5–10 times, and then attempt to access the site for the first time. If the user had not changed their password since the last time they accessed the site, the attacker would be in.
Timeline
Published on: 09/12/2022 21:15:00 UTC
Last modified on: 09/15/2022 04:14:00 UTC