Simple Customer 'profile.php' Remote Password Change Vulnerability
BID:34872
Info
Simple Customer 'profile.php' Remote Password Change Vulnerability
| Bugtraq ID: | 34872 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | May 07 2009 12:00AM |
| Updated: | Jul 13 2010 07:07PM |
| Credit: | ahmadbady |
| Vulnerable: |
Simple Customer Simple Customer 1.3 |
| Not Vulnerable: |
Simple Customer Simple Customer 1.5 |
Discussion
Simple Customer 'profile.php' Remote Password Change Vulnerability
Simple Customer is prone to a vulnerability that may permit an attacker to change the password of arbitrary users.
Exploiting this issue may allow the attacker to gain unauthorized access to the affected application. Successful exploits will completely compromise the victims' account.
Simple Customer 1.3 is vulnerable; other versions may also be affected.
Simple Customer is prone to a vulnerability that may permit an attacker to change the password of arbitrary users.
Exploiting this issue may allow the attacker to gain unauthorized access to the affected application. Successful exploits will completely compromise the victims' account.
Simple Customer 1.3 is vulnerable; other versions may also be affected.
Exploit / POC
Simple Customer 'profile.php' Remote Password Change Vulnerability
Attackers can use a browser to exploit this issue.
The following exploit is available:
Attackers can use a browser to exploit this issue.
The following exploit is available:
Solution / Fix
Simple Customer 'profile.php' Remote Password Change Vulnerability
Solution:
This issue has been resolved in Simple Customer 1.5. Please see the references for more details.
Solution:
This issue has been resolved in Simple Customer 1.5. Please see the references for more details.
References
Simple Customer 'profile.php' Remote Password Change Vulnerability
References:
References:
- Download Simple Customer 1.5 (Simple Customer)
- Simple Customer Homepage (Simple Customer)