PT-2007-4885 · Avtutorial · Av Tutorial Script

Dj7Xpl · Publicado 2007-07-10 · Atualizado 2017-09-29 · CVE-2007-3630

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions AV Tutorial Script (avtutorial) version 1.0

Description The issue allows remote attackers to change passwords for arbitrary users without requiring authentication or knowledge of the old password. This is achieved by modifying the password parameter in the "changePW.php" file.

Recommendations For AV Tutorial Script (avtutorial) version 1.0, consider implementing authentication and old password verification requirements for the password change functionality in the "changePW.php" file to prevent unauthorized password changes. As a temporary workaround, restrict access to the "changePW.php" file until a proper fix is implemented.

Exploit

Correção

Identificadores relacionados

CVE-2007-3630

Produtos afetados

Av Tutorial Script

Referências · 6

• 🔥 https://exploit-db.com/exploits/4163 · Exploit
• http://attrition.org/pipermail/vim/2007-July/001705.html · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35295 · Nota
• http://securityfocus.com/bid/24808 · Nota
• http://osvdb.org/42461 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-3630 · Nota de Segurança