ClanWeb 'save.php' Remote Password Change Vulnerability
BID:35012
Info
ClanWeb 'save.php' Remote Password Change Vulnerability
| Bugtraq ID: | 35012 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | May 18 2009 12:00AM |
| Updated: | May 19 2009 08:10PM |
| Credit: | ahmadbady |
| Vulnerable: |
E4Network ClanWeb 1.4.2 |
| Not Vulnerable: | |
Discussion
ClanWeb 'save.php' Remote Password Change Vulnerability
ClanWeb is prone to a vulnerability that may permit an attacker to change the password of arbitrary users.
Exploiting this issue may allow the attacker to gain unauthorized access to the affected application. Successful exploits will completely compromise victims' accounts.
ClanWeb 1.4.2 is vulnerable; other versions may also be affected.
ClanWeb is prone to a vulnerability that may permit an attacker to change the password of arbitrary users.
Exploiting this issue may allow the attacker to gain unauthorized access to the affected application. Successful exploits will completely compromise victims' accounts.
ClanWeb 1.4.2 is vulnerable; other versions may also be affected.
Exploit / POC
ClanWeb 'save.php' Remote Password Change Vulnerability
Attackers can use a browser to exploit this issue.
The following exploit is available:
Attackers can use a browser to exploit this issue.
The following exploit is available:
Solution / Fix
ClanWeb 'save.php' Remote Password Change Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].