CVE-2008-6673 in QuickerSite
Summary
by MITRE
asp/bs_login.asp in QuickerSite 1.8.5 does not properly restrict access to administrative functionality, which allows remote attackers to (1) change the admin password via the cSaveAdminPW action; (2) modify site information, such as the contact address, via the saveAdmin; and (3) modify the site design via the saveDesign action.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/24/2025
The vulnerability identified as CVE-2008-6673 affects QuickerSite version 1.8.5 and resides within the asp/bs_login.asp component of the application. This flaw represents a critical access control weakness that undermines the security posture of the web application by failing to properly validate user privileges before permitting administrative actions. The vulnerability stems from insufficient input validation and authentication checks that allow unauthenticated or unauthorized users to execute administrative functions through specific action parameters.
The technical implementation of this vulnerability manifests through three distinct attack vectors that all exploit the same underlying access control flaw. Attackers can leverage the cSaveAdminPW action to change administrative passwords, effectively gaining persistent access to the system. The saveAdmin action enables modification of critical site information including contact addresses and other administrative details. Additionally, the saveDesign action allows attackers to alter the site's visual appearance and potentially introduce malicious content or redirect users to harmful destinations. These actions demonstrate a complete breakdown in privilege separation where administrative functions are accessible without proper authentication or authorization checks.
The operational impact of this vulnerability is severe and multifaceted. An attacker who successfully exploits this vulnerability can completely compromise the targeted website by assuming administrative control. This includes not only changing passwords to lock out legitimate administrators but also modifying core site information that can affect user trust and business operations. The ability to modify site design presents additional risks including the potential for defacement, injection of malicious scripts, or redirection to phishing sites that could compromise visitor credentials. The vulnerability essentially provides a backdoor that allows attackers to take complete control of the website's administrative functions without requiring legitimate credentials.
This vulnerability aligns with CWE-285, which addresses improper authorization issues in software applications, and represents a classic example of insufficient access control mechanisms. The flaw also corresponds to ATT&CK technique T1078.004, which covers legitimate credentials, as attackers can effectively bypass authentication mechanisms to gain administrative access. Organizations using QuickerSite 1.8.5 should immediately implement mitigations including input validation for all action parameters, implementation of proper authentication checks before administrative actions, and consideration of the principle of least privilege. The vulnerability demonstrates the critical importance of proper access control implementation in web applications and highlights the need for comprehensive security testing of administrative interfaces to prevent unauthorized access to sensitive functions.