Ecartis Hidden Form Field Password Modification Vulnerability

Bugtraq ID:	6971
Class:	Input Validation Error
CVE:	CVE-2003-0162
Remote:	Yes
Local:	No
Published:	Feb 27 2003 12:00AM
Updated:	Jul 11 2009 08:06PM
Credit:	Discovery of this vulnerability credited to Haluk AYDIN <[email protected]>.
Vulnerable:	Ecartis Ecartis 1.0 .0 snapshot 20021013
Not Vulnerable:	Ecartis Ecartis 1.0 .0 snapshot 20030227

Ecartis Hidden Form Field Password Modification Vulnerability

A vulnerability has been reported for Ecartis that may allow attackers to modify passwords.

An attacker can exploit this vulnerability by modifying hidden fields in HTML pages and submitting them. This will allow an attacker to authenticate as a privileged user of Ecartis and modify passwords.

Ecartis Hidden Form Field Password Modification Vulnerability

There is no exploit code required.

Ecartis Hidden Form Field Password Modification Vulnerability

Solution:
The vendor has stated that Ecartis 1.0.0 snapshot dated 20030227 and later are not vulnerable to this issue.

Affected users are advised to upgrade vulnerable versions of Ecartis.

Debian has released fixes for this issue. See the advisory in the References section for links to fixes.

Ecartis Hidden Form Field Password Modification Vulnerability

References:

• Ecartis (Ecartis)
  
• Ecardis Password Reseting Vulnerability (Haluk AYDIN )
  
• Re: Ecardis Password Reseting Vulnerability (Trish Lynch )