JobScript 'changepassword.php' Remote Password Change Vulnerability
BID:34874
Info
JobScript 'changepassword.php' Remote Password Change Vulnerability
| Bugtraq ID: | 34874 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | May 07 2009 12:00AM |
| Updated: | May 08 2009 06:06PM |
| Credit: | TiGeR-Dz |
| Vulnerable: |
JobScript JobScript 2.0 |
| Not Vulnerable: | |
Discussion
JobScript 'changepassword.php' Remote Password Change Vulnerability
JobScript is prone to a vulnerability that may permit an attacker to change the password of arbitrary users.
Exploiting this issue may allow the attacker to gain unauthorized access to the affected application. Successful exploits will completely compromise victims' accounts.
JobScript 2.0 is vulnerable; other versions may also be affected.
JobScript is prone to a vulnerability that may permit an attacker to change the password of arbitrary users.
Exploiting this issue may allow the attacker to gain unauthorized access to the affected application. Successful exploits will completely compromise victims' accounts.
JobScript 2.0 is vulnerable; other versions may also be affected.
Exploit / POC
JobScript 'changepassword.php' Remote Password Change Vulnerability
Attackers can use a browser to exploit this issue.
The following exploit is available:
Attackers can use a browser to exploit this issue.
The following exploit is available:
Solution / Fix
JobScript 'changepassword.php' Remote Password Change Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
JobScript 'changepassword.php' Remote Password Change Vulnerability
References:
References:
- Simple Customer Homepage (Simple Customer)