PT-2009-2655 · Clipshare · Clipshare

Pr0Metheus · Published 2009-09-09 · Updated 2017-09-29 · CVE-2008-7188

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ClipShare version 2.6

Description The issue allows remote attackers to change the profile of arbitrary users by modifying the uid variable in the "siteadmin/useredit.php" endpoint. This can be exploited to recover a user's password by using a modified e-mail address in the email parameter to "recoverpass.php".

Recommendations For ClipShare version 2.6, consider restricting access to the "siteadmin/useredit.php" and "recoverpass.php" endpoints until a proper fix is available. As a temporary workaround, restrict the use of the uid variable and the email parameter in these endpoints to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2008-7188

Affected Products

Clipshare

References · 6

• 🔥 https://exploit-db.com/exploits/4837 · Exploit
• 🔥 http://securityfocus.com/bid/27148 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-7188 · Security Note
• http://secunia.com/advisories/28313 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39494 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-7188 · Note