REDAXO before 5.21.5 Privilege Escalation via Backup Export of Authentication Tables
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 5.21.5
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
REDAXO, a PHP content management system, is affected in versions before 5.21.5. A user with only backup export permission could download sensitive database tables, including user accounts, active session IDs, and password hashes, which could allow them to take over administrator accounts or crack passwords offline.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
REDAXO before 5.21.5 contains a missing authorization vulnerability in the backup addon export that accepts any database table, allowing non-admin users with the backup[export] permission to export rex_user, rex_user_session, and other applications' tables. Attackers can obtain plaintext session ids and stay-logged-in keys to take over admin accounts, or password hashes for offline cracking.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- redaxo core
fixed in 5.21.5