PT-2008-6363 · Unknown · Wportfolio

G4N0K · Published 2008-11-25 · Updated 2017-09-29 · CVE-2008-5221

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions wPortfolio versions 0.3 and earlier

Description The issue concerns the account save action in the admin/userinfo.php file, which does not require authentication and does not demand knowledge of the original password. This allows remote attackers to change the admin account password by modifying the password and password retype parameters.

Recommendations For wPortfolio versions 0.3 and earlier, consider disabling the account save action in admin/userinfo.php until a patch is available. Restrict access to the admin/userinfo.php file to minimize the risk of exploitation. Avoid using the password and password retype parameters in the affected action until the issue is resolved.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2008-5221

Affected Products

Wportfolio

References · 6

• 🔥 https://exploit-db.com/exploits/7170 · Exploit
• 🔥 http://securityfocus.com/bid/32384 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-5221 · Security Note
• http://vupen.com/english/advisories/2008/3219 · Note
• http://securityreason.com/securityalert/4631 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46772 · Note