PT-2006-6654 · Webevents · Webevents

Ajann · Published 2006-11-21 · Updated 2018-10-17 · CVE-2006-6007

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions WebEvents (Online Event Registration Template) versions 2.0 and earlier

Description The issue allows remote attackers to modify user profiles, passwords, and other information for any user by manipulating the UserID parameter in the save profile.asp file.

Recommendations For WebEvents (Online Event Registration Template) versions 2.0 and earlier, avoid using the UserID parameter in the save profile.asp file until a fix is available. Consider restricting access to the save profile.asp file to prevent unauthorized modifications.

Fix

Related Identifiers

CVE-2006-6007

Affected Products

Webevents

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2006-6007 · Security Note
• http://securityfocus.com/archive/1/451411/100/0/threaded · Note
• http://securityreason.com/securityalert/1888 · Note