PT-2019-15225 · Eyecomms · Eyecms

Ahmyth · Publicado 2019-11-07 · Atualizado 2020-08-24 · CVE-2019-17605

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions eyecomms eyeCMS versions prior to 2019-10-15

Description A mass assignment issue allows any candidate to take over another candidate's account by exploiting a modified candidate id and an additional password parameter, resulting in the password of the targeted candidate being changed.

Recommendations For versions prior to 2019-10-15, consider restricting access to the account management functionality to prevent exploitation until a fix is available. Avoid using the password parameter in conjunction with a modified candidate id to minimize the risk of account takeover.

Exploit

Correção

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2019-17605

Produtos afetados

Eyecms

Referências · 4

• 🔥 https://gist.github.com/AhMyth/6d9c5e15d943dd092ccca19fca8d5d37 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-17605 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-17605 · Aviso do Fabricante
• http://eyecomms.com/Products/eyeCMS.html · Aviso do Fabricante