Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2008-2349: Zomplog lets remote attackers create admin accounts
CVE-2008-2349 · published 18 years ago
Summary
The Zomplog web logging tool (version 3.8.2 and older) can be tricked into adding a new user with full administrator rights. An attacker can do this by sending a specially crafted request to a specific page on the server. Apply the latest update from the vendor or block access to the install/newuser.php endpoint until the software is patched.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| zomp | zomplog |
<= 3.8.2 cpe:2.3:a:zomp:zomplog:*:*:*:*:*:*:*:* |
Original advisory text
Zomplog 3.8.2 and earlier allows remote attackers to gain administrative access by creating an admin account via a direct request to install/newuser.php with the admin parameter set to 1.
Zomplog 3.8.2 and earlier allows remote attackers to gain administrative access by creating an admin account via a direct request to install/newuser.php with the admin parameter set to 1.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Severity
7.5
High
Type
CWE-264Permissions, Privileges, and Access Controls
Timeline
Published20 May 2008
Updated29 Oct 2026
First seen29 Sep 2026
Sources
CVE-2008-2349 · NVD
Track software like this
Free during beta