PT-2010-1732 · Totalcalendar · Totalcalendar

The G0Bl!N · Published 2010-07-09 · Updated 2017-09-19 · CVE-2009-4929

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions TotalCalendar version 2.4

Description The issue concerns a lack of administrative authentication in the admin/manage users.php file, allowing remote attackers to change arbitrary passwords using the newPW1 and newPW2 parameters.

Recommendations For TotalCalendar version 2.4, ensure that administrative authentication is properly implemented for the admin/manage users.php file to prevent unauthorized password changes. As a temporary workaround, consider restricting access to the admin/manage users.php file until a proper fix is applied.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2009-4929

Affected Products

Totalcalendar

References · 5

• 🔥 https://exploit-db.com/exploits/8496 · Exploit
• 🔥 http://securityfocus.com/bid/34619 · Exploit
• 🔥 http://exploit-db.com/exploits/8496 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-4929 · Security Note
• http://secunia.com/advisories/34824 · Vendor Advisory