VisionLMS 'changePW.php' Remote Password Change Vulnerability
BID:34749
Info
VisionLMS 'changePW.php' Remote Password Change Vulnerability
| Bugtraq ID: | 34749 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 28 2009 12:00AM |
| Updated: | Apr 29 2009 05:46PM |
| Credit: | Mr.tro0oqy |
| Vulnerable: |
Visionair VisionLMS 1.0 |
| Not Vulnerable: | |
Discussion
VisionLMS 'changePW.php' Remote Password Change Vulnerability
VisionLMS is prone to a vulnerability that may permit an attacker to change the password of arbitrary users.
Exploiting this issue may allow the attacker to gain unauthorized access to the affected application. Successful exploits will completely compromise victims' accounts.
VisionLMS 1.0 is vulnerable; other versions may also be affected.
VisionLMS is prone to a vulnerability that may permit an attacker to change the password of arbitrary users.
Exploiting this issue may allow the attacker to gain unauthorized access to the affected application. Successful exploits will completely compromise victims' accounts.
VisionLMS 1.0 is vulnerable; other versions may also be affected.
Exploit / POC
VisionLMS 'changePW.php' Remote Password Change Vulnerability
Attackers can use a browser to exploit this issue.
The following exploit is available:
Attackers can use a browser to exploit this issue.
The following exploit is available:
Solution / Fix
VisionLMS 'changePW.php' Remote Password Change Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
VisionLMS 'changePW.php' Remote Password Change Vulnerability
References:
References:
- VisionLMS Homepage (Visionair)