PT-2006-1236 · Reamday Enterprises · Magic News Plus

Publicado 2006-01-10 · Atualizado 2008-09-05 · CVE-2006-0157

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Reamday Enterprises Magic News Plus version 1.0.3

Description The issue allows remote attackers to change the administrator password. This is achieved by specifying identical values for the passwd and admin password parameters in a change action, then declaring the new password string in the new passwd and confirm passwd parameters.

Recommendations For Reamday Enterprises Magic News Plus version 1.0.3, consider restricting access to the settings.php file to prevent unauthorized password changes until a fix is available. As a temporary workaround, avoid using the passwd and admin password parameters with identical values in change actions.

Exploit

Correção

Identificadores relacionados

CVE-2006-0157

Produtos afetados

Magic News Plus

Referências · 5

• 🔥 http://securityfocus.com/bid/16182 · Exploit
• 🔥 https://exploit-db.com/exploits/1410 · Exploit
• 🔥 http://downloads.securityfocus.com/vulnerabilities/exploits/MagicNewsPlus-pw-change.pl · Exploit
• http://secunia.com/advisories/18601 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-0157 · Nota de Segurança