critical9.0Public exploit code
CVE-2007-6237
cp.php in DeluxeBB 1.09 does not verify that the membercookie parameter corresponds to the authenticated member during a profile update, which allows remote au…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- DeluxeBB 1.09 - Remote Admin Email Change2007-11-26 · webapps · php · Verified
Impact
cp.php in DeluxeBB 1.09 does not verify that the membercookie parameter corresponds to the authenticated member during a profile update, which allows remote authenticated users to change the e-mail addresses of arbitrary accounts via a modified membercookie parameter, a different vector than CVE-2006-4078. NOTE: this can be leveraged for administrative access by requesting password-reset e-mail through a lostpw action to misc.php.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Deluxebb | Deluxebb | Version 1.09 |
Weakness classification
References
- NVD record
- CVE.org record
- http://secunia.com/advisories/27794
- http://securityreason.com/securityalert/3416
- http://www.securityfocus.com/archive/1/484205/100/0/threaded
- http://www.securityfocus.com/bid/26572
- http://secunia.com/advisories/27794
- http://securityreason.com/securityalert/3416
- http://www.securityfocus.com/archive/1/484205/100/0/threaded
- http://www.securityfocus.com/bid/26572