PT-2010-1732 · Totalcalendar · Totalcalendar

The G0Bl!N · Publicado 2010-07-09 · Atualizado 2017-09-19 · CVE-2009-4929

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions TotalCalendar version 2.4

Description The issue concerns a lack of administrative authentication in the admin/manage users.php file, allowing remote attackers to change arbitrary passwords using the newPW1 and newPW2 parameters.

Recommendations For TotalCalendar version 2.4, ensure that administrative authentication is properly implemented for the admin/manage users.php file to prevent unauthorized password changes. As a temporary workaround, consider restricting access to the admin/manage users.php file until a proper fix is applied.

Exploit

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2009-4929

Produtos afetados

Totalcalendar

Referências · 5

• 🔥 https://exploit-db.com/exploits/8496 · Exploit
• 🔥 http://securityfocus.com/bid/34619 · Exploit
• 🔥 http://exploit-db.com/exploits/8496 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-4929 · Nota de Segurança
• http://secunia.com/advisories/34824 · Aviso do Fabricante