|
CVE Reference: CVE-2007-6237
|
|
NOTE: The text on this page is written by CVE MITRE and reflects neither the opinions of Secunia or the results of our research. All data on this page is written and maintained by CVE MITRE.
|
|
Original Page at CVE MITRE:
CVE-2007-6237
|
|
Description:
cp.php in DeluxeBB 1.09 does not verify that the membercookie parameter corresponds to the authenticated member during a profile update, which allows remote authenticated users to change the e-mail addresses of arbitrary accounts via a modified membercookie parameter, a different vector than CVE-2006-4078. NOTE: this can be leveraged for administrative access by requesting password-reset e-mail through a lostpw action to misc.php.
|
|
CVE Status:
Candidate
|
|
References:
SREASON
http://securityreason.com/securityalert/3416
SAID
Secunia Advisory: SA27794
BUGTRAQ
http://www.securityfocus.com/archive/1/archive/1/484205/100/0/threaded
BID
26572
|
|
|
Return to the previous page.
|
