CVE-2009-1489
includes/user.php in Fungamez RC1 allows remote attackers to bypass authentication and gain...
CVE-2009-1489 is a high vulnerability (CVSS 7.5) in Rens Rikkerink Fungamez, published April 29, 2009. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 2.54%, the 85th percentile. No source names a fixed version.
- Severity
- 7.5 HighCVSS 2.0, NVD
- Exploit chance
- 2.54%EPSS, 85th percentile
- Exploitation
- None known1 public exploit
- Fixed in
- No fix listedNo source names one
Description
includes/user.php in Fungamez RC1 allows remote attackers to bypass authentication and gain administrative access by setting the user cookie parameter.
Exploit likelihood
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | fungamez rc1 - Authentication Bypass / Local File Inclusion | 2009-04-20 |
What each source reports
NVD Score used
includes/user.php in Fungamez RC1 allows remote attackers to bypass authentication and gain administrative access by setting the user cookie parameter.
- Record
CVE-2009-1489- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-287
- Updated
- 2026-11-02
CVE ListNo score
includes/user.php in Fungamez RC1 allows remote attackers to bypass authentication and gain administrative access by setting the user cookie parameter.
- Record
CVE-2009-1489- Updated
- 2026-11-02
EUVDEUVD-2009-1486No score
includes/user.php in Fungamez RC1 allows remote attackers to bypass authentication and gain administrative access by setting the user cookie parameter.
- Record
EUVD-2009-1486- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5m9r-px69-w4v3No score
includes/user.php in Fungamez RC1 allows remote attackers to bypass authentication and gain...
includes/user.php in Fungamez RC1 allows remote attackers to bypass authentication and gain administrative access by setting the user cookie parameter.
- Record
GHSA-5m9r-px69-w4v3- Weakness
- CWE-287
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.