vendor:
User Pass Change
by:
ajann
7.5
CVSS
HIGH
User Pass Change
287
CWE
Product Name: User Pass Change
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2020
Speedy Forum User Pass Change
This exploit allows an attacker to change the user password of a Speedy Forum user by submitting a form with the user's name, email, ID, country, password, and re-password. The form does not have any authentication or authorization checks, allowing an attacker to change the user's password without their knowledge.
Mitigation:
Implement authentication and authorization checks on the form to ensure that only authorized users can change the user's password.
