AV Tutorial Script ChangePW.PHP Security Bypass Vulnerability

Bugtraq ID:	24808
Class:	Design Error
CVE:	CVE-2007-3630
Remote:	Yes
Local:	No
Published:	Jul 08 2007 12:00AM
Updated:	May 07 2015 05:37PM
Credit:	Dj7xpl discovered this issue.
Vulnerable:	AV Scripts AV Tutorial Script 1.0
Not Vulnerable:

AV Tutorial Script ChangePW.PHP Security Bypass Vulnerability

AV Tutorial Script is prone to a vulnerability that may allow remote attackers to change a user's password. This issue occurs due to a design error that affects the 'changePW.php' script.

AV Tutorial Script 1.0 is reported vulnerable; other versions may be affected as well.

AV Tutorial Script ChangePW.PHP Security Bypass Vulnerability

Attackers may exploit this issue through a browser.

A proof of concept is available:

• /data/vulnerabilities/exploits/avtutorial_poc.txt

AV Tutorial Script ChangePW.PHP Security Bypass Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

AV Tutorial Script ChangePW.PHP Security Bypass Vulnerability

References:

• AV Tutorial Script (AV Scripts)