Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.5

DeStar 0.2.2-5 lets logged‑in users add admins and run code

CVE-2008-6539 · published 17 years ago
Summary

In DeStar version 0.2.2-5, a user who is already logged in can change a setting file to give themselves administrator rights and execute any Python commands on the server. This could let an attacker take control of the application and its data. Apply the vendor's security update or restrict access to the settings area until a patch is installed.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
holger_schurig destar 0.2.2-5
cpe:2.3:a:holger_schurig:destar:0.2.2-5:*:*:*:*:*:*:*
Original advisory text
Static code injection vulnerability in user/settings/ in DeStar 0.2.2-5 allows remote authenticated users to add arbitrary administrators and inject arbitrary Python code into destar_cfg.py via a c...
Static code injection vulnerability in user/settings/ in DeStar 0.2.2-5 allows remote authenticated users to add arbitrary administrators and inject arbitrary Python code into destar_cfg.py via a crafted pin parameter.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
6.5 Medium
Exploitation
2% chance of attack within 30 days
Type
CWE-94Code Injection
Timeline
Published30 Mar 2009
Updated29 Oct 2026
First seen29 Sep 2026
Sources
CVE-2008-6539 · NVD
Track software like this
Free during beta