Template Monster Clone 'edituser.php' Remote Password Change Vulnerability
BID:34977
Info
Template Monster Clone 'edituser.php' Remote Password Change Vulnerability
| Bugtraq ID: | 34977 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | May 14 2009 12:00AM |
| Updated: | May 15 2009 07:36PM |
| Credit: | TiGeR-Dz |
| Vulnerable: |
2daybiz Template Monster Clone 0 |
| Not Vulnerable: | |
Discussion
Template Monster Clone 'edituser.php' Remote Password Change Vulnerability
Template Monster Clone is prone to a vulnerability that may permit an attacker to change the password of arbitrary users.
Exploiting this issue may allow the attacker to gain unauthorized access to the affected application. Successful exploits will completely compromise victims' accounts.
Template Monster Clone is prone to a vulnerability that may permit an attacker to change the password of arbitrary users.
Exploiting this issue may allow the attacker to gain unauthorized access to the affected application. Successful exploits will completely compromise victims' accounts.
Exploit / POC
Template Monster Clone 'edituser.php' Remote Password Change Vulnerability
Attackers can use a browser to exploit this issue.
The following exploit is available:
Attackers can use a browser to exploit this issue.
The following exploit is available:
Solution / Fix
Template Monster Clone 'edituser.php' Remote Password Change Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Template Monster Clone 'edituser.php' Remote Password Change Vulnerability
References:
References:
- Template Monster Clone Homepage (2daybiz)