PT-2019-15225 · Eyecomms · Eyecms

Ahmyth · Published 2019-11-07 · Updated 2020-08-24 · CVE-2019-17605

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions eyecomms eyeCMS versions prior to 2019-10-15

Description A mass assignment issue allows any candidate to take over another candidate's account by exploiting a modified candidate id and an additional password parameter, resulting in the password of the targeted candidate being changed.

Recommendations For versions prior to 2019-10-15, consider restricting access to the account management functionality to prevent exploitation until a fix is available. Avoid using the password parameter in conjunction with a modified candidate id to minimize the risk of account takeover.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2019-17605

Affected Products

Eyecms

References · 4

• 🔥 https://gist.github.com/AhMyth/6d9c5e15d943dd092ccca19fca8d5d37 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-17605 · Security Note
• https://osv.dev/vulnerability/CVE-2019-17605 · Vendor Advisory
• http://eyecomms.com/Products/eyeCMS.html · Vendor Advisory