PT-2010-1484 · Mole · Mole Group Sky Hunter Bus Ticket Script+1

G4N0K · Published 2010-03-05 · Updated 2017-09-19 · CVE-2009-4674

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Mole Group Sky Hunter Airline Ticket Sale Script and Bus Ticket Script (affected versions not specified)

Description The issue allows remote attackers to change an arbitrary password by modifying the user id field in the admin/admin.php script.

Recommendations For Mole Group Sky Hunter Airline Ticket Sale Script and Bus Ticket Script, restrict access to the admin/admin.php script to minimize the risk of exploitation. Avoid using the user id field in the affected script until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2009-4674

Affected Products

Mole Group Sky Hunter Airline Ticket Sale Script

Mole Group Sky Hunter Bus Ticket Script

References · 5

• 🔥 http://exploit-db.com/exploits/8774 · Exploit
• 🔥 https://exploit-db.com/exploits/8774 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-4674 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/50722 · Note
• http://securityfocus.com/bid/35079 · Note