PT-2007-6600 · Pligg · Pligg Cms

Published 2007-10-18 · Updated 2017-07-29 · CVE-2007-5579

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Pligg CMS version 9.5

Description The issue concerns a password reset mechanism in Pligg CMS. Specifically, the login.php file uses a guessable confirmation code, allowing remote attackers with knowledge of a username to reset that user's password by calculating the confirmationcode parameter.

Recommendations For Pligg CMS version 9.5, consider temporarily disabling the password reset feature in login.php until a secure alternative is implemented to prevent exploitation. Restrict access to the login.php file to minimize the risk of unauthorized password resets. Avoid using the confirmationcode parameter in the password reset process until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2007-5579

Affected Products

Pligg Cms

References · 7

• 🔥 http://securityfocus.com/bid/24158 · Exploit
• 🔥 https://exploit-db.com/exploits/30088 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-5579 · Security Note
• http://archives.neohapsis.com/archives/bugtraq/2007-05/0383.html · Note
• http://osvdb.org/42031 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34512 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5579 · Note