medium5.0Public exploit code
CVE-2009-1767
admin/edituser.php in 2daybiz Template Monster Clone does not require administrative authentication, which allows remote attackers to modify arbitrary accounts…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- 2DayBiz Template Monster Clone - 'edituser.php' Change Pass2009-05-14 · webapps · php · Verified
Impact
admin/edituser.php in 2daybiz Template Monster Clone does not require administrative authentication, which allows remote attackers to modify arbitrary accounts via the (1) loginname, (2) password, (3) email, (4) firstname, or (5) lastname parameter.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| 2daybiz | Template Monster Clone | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- http://secunia.com/advisories/35090
- http://www.securityfocus.com/bid/34977
- https://exchange.xforce.ibmcloud.com/vulnerabilities/50561
- https://www.exploit-db.com/exploits/8691
- http://secunia.com/advisories/35090
- http://www.securityfocus.com/bid/34977
- https://exchange.xforce.ibmcloud.com/vulnerabilities/50561
- https://www.exploit-db.com/exploits/8691