ReVou 'adminlogin/password.php' Remote Password Change Vulnerability
BID:34851
Info
ReVou 'adminlogin/password.php' Remote Password Change Vulnerability
| Bugtraq ID: | 34851 |
| Class: | Access Validation Error |
| CVE: |
CVE-2008-6752 |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 19 2008 12:00AM |
| Updated: | May 06 2009 10:26PM |
| Credit: | G4N0K |
| Vulnerable: |
ReVou ReVou 0 |
| Not Vulnerable: | |
Discussion
ReVou 'adminlogin/password.php' Remote Password Change Vulnerability
ReVou is prone to a vulnerability that may permit an attacker to change the password of arbitrary users.
Exploiting this issue may allow the attacker to gain unauthorized access to the affected application. Successful exploits will completely compromise victims' accounts.
ReVou is prone to a vulnerability that may permit an attacker to change the password of arbitrary users.
Exploiting this issue may allow the attacker to gain unauthorized access to the affected application. Successful exploits will completely compromise victims' accounts.
Exploit / POC
ReVou 'adminlogin/password.php' Remote Password Change Vulnerability
Attackers can use a browser to exploit this issue.
The following exploit is available:
Attackers can use a browser to exploit this issue.
The following exploit is available:
Solution / Fix
ReVou 'adminlogin/password.php' Remote Password Change Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
ReVou 'adminlogin/password.php' Remote Password Change Vulnerability
References:
References:
- ReVou Homepage (ReVou)