CVE-2006-5777 in Creasito E-Commerce Content Manager
Summary
by MITRE
Creasito E-Commerce Content Manager 1.3.08 allows remote attackers to bypass authentication and perform privileged functions via a non-empty finame parameter to (1) addnewcont.php, (2) adminpassw.php, (3) amministrazione.php, (4) artins.php, (5) bgcolor.php, (6) cancartcat.php, (7) canccat.php, (8) cancelart.php, (9) cancontsit.php, (10) chanpassamm.php, (11) dele.php, (12) delecat.php, (13) delecont.php, (14) emailall.php, (15) gestflashtempl.php, (16) gestmagart.php, (17) gestmagaz.php, (18) gestpre.php, (19) input.php, (20) input3.php, (21) insnucat.php, (22) instempflash.php, (23) mailfc.php, (24) modfdati.php, (25) rescont4.php, (26) ricordo1.php, (27) ricordo4.php, (28) tabcatalg.php, (29) tabcont.php, (30) tabcont3.php, (31) tabstile.php, (32) tabstile3.php, (33) testimmg.php, and (34) update.php in admin/. NOTE: some of these details are obtained from third party information.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 04/26/2026
This vulnerability represents a critical authentication bypass flaw in Creasito E-Commerce Content Manager version 1.3.08 that allows remote attackers to execute privileged administrative functions without proper authorization. The vulnerability manifests through a specific parameter manipulation technique where an attacker can supply a non-empty finame parameter to multiple administrative scripts located in the admin/ directory of the application. This flaw directly violates fundamental security principles by permitting unauthorized access to sensitive administrative operations that should only be available to authenticated administrators.
The technical implementation of this vulnerability stems from inadequate input validation and authentication checks within the affected scripts. When a non-empty finame parameter is passed to any of the listed PHP files, the application fails to properly verify the user's administrative privileges before executing privileged operations. This represents a classic case of insufficient authorization checks and weak input sanitization, which aligns with CWE-285: Improper Authorization and CWE-20: Improper Input Validation. The vulnerability affects a comprehensive list of 34 administrative endpoints, suggesting a systemic flaw in the application's access control implementation rather than isolated script-level issues.
The operational impact of this vulnerability is severe as it provides attackers with complete administrative control over the e-commerce platform. Successful exploitation enables unauthorized users to modify content, manage users, alter product catalogs, change system configurations, and potentially access sensitive data including customer information and financial records. This authentication bypass represents a significant threat to the confidentiality, integrity, and availability of the affected system. The vulnerability's remote nature means that attackers do not require physical access or local network presence to exploit the flaw, making it particularly dangerous in production environments. Organizations using this software face potential data breaches, unauthorized modifications, and complete system compromise.
The vulnerability maps to several ATT&CK techniques including T1078: Valid Accounts for maintaining persistence and T1566: Phishing for initial access, while also supporting T1003: OS Credential Dumping and T1021: Remote Services for lateral movement. Mitigation strategies should include immediate patching of the application to version 1.3.09 or later, which addresses this authentication bypass flaw. Network segmentation should be implemented to limit access to administrative endpoints, and proper input validation should be enforced through parameter sanitization. Additionally, organizations should implement robust monitoring of administrative access patterns and consider deploying web application firewalls to detect and block suspicious parameter manipulation attempts. The vulnerability demonstrates the critical importance of proper access control implementation and input validation in web applications, particularly those handling sensitive commerce data.