low3.5Public exploit code
CVE-2006-6822
myprofile.asp in Enthrallweb eClassifieds does not properly validate the MM_recordId parameter during profile updates, which allows remote authenticated users …
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Enthrallweb eClassifieds 1.0 - Remote User Pass Change2006-12-23 · webapps · asp · Verified
Impact
myprofile.asp in Enthrallweb eClassifieds does not properly validate the MM_recordId parameter during profile updates, which allows remote authenticated users to modify certain profile fields of another account by specifying that account's username in a modified MM_recordId parameter.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Enthrallweb | Eclassifieds | All versions |