high7.5Public exploit code
CVE-2008-6957
member.php in Crossday Discuz!
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Discuz! - Remote Reset User Password2008-11-22 · webapps · php · Verified
Impact
member.php in Crossday Discuz! Board allows remote attackers to reset passwords of arbitrary users via crafted (1) lostpasswd and (2) getpasswd actions, possibly involving predictable generation of the id parameter.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Discuz | Discuz\! | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- http://secunia.com/advisories/32731
- http://www.80vul.com/dzvul/sodb/14/dz-exp-sodb-2008-14_php.htm
- http://www.discuz.net/archiver/?tid-1112426.html
- http://www.securityfocus.com/bid/32424
- https://exchange.xforce.ibmcloud.com/vulnerabilities/46785
- https://www.exploit-db.com/exploits/7185
- http://secunia.com/advisories/32731
- http://www.80vul.com/dzvul/sodb/14/dz-exp-sodb-2008-14_php.htm
- http://www.discuz.net/archiver/?tid-1112426.html
- http://www.securityfocus.com/bid/32424
- https://exchange.xforce.ibmcloud.com/vulnerabilities/46785
- https://www.exploit-db.com/exploits/7185