Multiple Mole Group Products 'admin.php' Remote Password Change Vulnerability

Bugtraq ID:	35079
Class:	Access Validation Error
CVE:	CVE-2009-4674
Remote:	Yes
Local:	No
Published:	May 22 2009 12:00AM
Updated:	Apr 13 2015 09:10PM
Credit:	G4N0K
Vulnerable:	Mole Group Restaurant Directory Script 3.0 Mole Group Bus Ticket Script 0 Mole Group Airline Ticket Script 0
Not Vulnerable:

Multiple Mole Group Products 'admin.php' Remote Password Change Vulnerability

Multiple Mole Group products are prone to a vulnerability that may permit an attacker to change the password of arbitrary users.

Exploiting this issue may allow the attacker to gain unauthorized access to the affected application. Successful exploits will completely compromise victims' accounts.

The following products are affected:

Restaurant Directory Script 3.0
Sky Hunter Script
Bus Ticket Script

Multiple Mole Group Products 'admin.php' Remote Password Change Vulnerability

Attackers can use a browser to exploit this issue.

The following exploit is available:

• /data/vulnerabilities/exploits/35079.html

Multiple Mole Group Products 'admin.php' Remote Password Change Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Multiple Mole Group Products 'admin.php' Remote Password Change Vulnerability

References:

• Vendor Homepage (Mole Group)