TotalCalendar 'manage_users.php' Remote Password Change Vulnerability

Bugtraq ID:	34619
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 20 2009 12:00AM
Updated:	Apr 22 2009 05:26PM
Credit:	ThE g0bL!N
Vulnerable:	Simpoe TotalCalendar 2.4
Not Vulnerable:

TotalCalendar 'manage_users.php' Remote Password Change Vulnerability

TotalCalendar is prone to a vulnerability that may permit an attacker to change the password of arbitrary users.

Exploiting this issue may allow the attacker to gain unauthorized access to the affected application. Successful exploits will completely compromise victims' accounts.

TotalCalendar 2.4 is vulnerable; other versions may also be affected.

TotalCalendar 'manage_users.php' Remote Password Change Vulnerability

Attackers can use a browser to exploit this issue.

The following exploit is available:

• /data/vulnerabilities/exploits/34619.txt

TotalCalendar 'manage_users.php' Remote Password Change Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

TotalCalendar 'manage_users.php' Remote Password Change Vulnerability

References:

• Simpoe Homepage (Simpoe)