PT-2008-6361 · Videoscript · Videoscript

G4N0K · Publicado 2008-11-25 · Atualizado 2017-09-29 · CVE-2008-5219

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions VideoScript versions 4.0.1.50 and earlier

Description The issue concerns the password change feature, specifically the "admin/cp.php" endpoint, which does not properly authenticate administrative access and does not require the original password to change the admin account password. This allows remote attackers to modify the admin account password by manipulating the npass and npass1 parameters.

Recommendations For VideoScript versions 4.0.1.50 and earlier, as a temporary workaround, consider disabling the password change feature in the "admin/cp.php" endpoint until a proper fix is available. Restrict access to the "admin/cp.php" endpoint to minimize the risk of exploitation. Avoid using the npass and npass1 parameters in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2008-5219

Produtos afetados

Videoscript

Referências · 5

• 🔥 https://exploit-db.com/exploits/7149 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-5219 · Nota de Segurança
• http://osvdb.org/49885 · Nota
• http://secunia.com/advisories/32718 · Aviso do Fabricante
• http://securityreason.com/securityalert/4634 · Nota