PT-2007-4885 · Avtutorial · Av Tutorial Script

Dj7Xpl · Published 2007-07-10 · Updated 2017-09-29 · CVE-2007-3630

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions AV Tutorial Script (avtutorial) version 1.0

Description The issue allows remote attackers to change passwords for arbitrary users without requiring authentication or knowledge of the old password. This is achieved by modifying the password parameter in the "changePW.php" file.

Recommendations For AV Tutorial Script (avtutorial) version 1.0, consider implementing authentication and old password verification requirements for the password change functionality in the "changePW.php" file to prevent unauthorized password changes. As a temporary workaround, restrict access to the "changePW.php" file until a proper fix is implemented.

Exploit

Fix

Related Identifiers

CVE-2007-3630

Affected Products

Av Tutorial Script

References · 6

• 🔥 https://exploit-db.com/exploits/4163 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-3630 · Security Note
• http://attrition.org/pipermail/vim/2007-July/001705.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35295 · Note
• http://securityfocus.com/bid/24808 · Note
• http://osvdb.org/42461 · Note