Snitz Forums Password.ASP Password-Reset Vulnerability

Bugtraq ID:	7925
Class:	Design Error
CVE:	CVE-2003-0494
Remote:	Yes
Local:	No
Published:	Jun 16 2003 12:00AM
Updated:	Jul 11 2009 10:06PM
Credit:	Discovery of this vulnerability has been credited to JeiAr <[email protected]>.
Vulnerable:	Snitz Forums 2000 Snitz Forums 2000 3.4 .03
Not Vulnerable:

Snitz Forums Password.ASP Password-Reset Vulnerability

Snitz Forums has been reported prone to a password-reset vulnerability. It has been reported that by requesting a forgotten password, an attacker may reset arbitrary account passwords.

This issue was reported in Snitz Forums 3.4.0.3, other versions might also be affected.

Snitz Forums Password.ASP Password-Reset Vulnerability

There is no exploit required.

Snitz Forums Password.ASP Password-Reset Vulnerability

Solution:
The vendor has supplied the following patch to address this issue:

At approximately line #85 replace the following first line with the second lines.

First:
strSql = strSql & " WHERE M_PWKEY = '" & key & "'"

Second:
strSql = strSql & " WHERE MEMBER_ID = " & cLng(Request.Form("MEMBER_ID"))
strSql = strSql & " AND M_PWKEY = '" & key & "'"

At approximately line #117 replace the following first line with the second lines.

First:
strSql = strSql & " WHERE MEMBER_ID = " & cLng(Request.Form("MEMBER_ID"))

Second:
strSql = strSql & " WHERE MEMBER_ID = " & cLng(Request.Form("MEMBER_ID"))
strSql = strSql & " AND M_PWKEY = '" & key & "'"