CVE-2023-53958: Weak Password Recovery Mechanism for Forgotten Password

LDAP Tool Box Self Service Password 1.5.2 contains a password reset vulnerability that allows attackers to manipulate HTTP Host headers during token generation. Attackers can craft malicious password reset requests that generate tokens sent to a controlled server, enabling potential account...

LDAP Tool Box Self Service Password v1.5.2 - Account takeover Vulnerability

Exploit Title: LDAP Tool Box Self Service Password v1.5.2 - Account takeover Exploit Author: Tahar BENNACEF aka tar.gz Software Link: https://github.com/ltb-project/self-service-password Version: 1.5.2 Tested on: Ubuntu Self Service Password is a PHP application that allows users to change their...

PT-2018-11160

Name of the Vulnerable Software and Affected Versions LTB aka LDAP Tool Box Self Service Password versions prior to 1.3 Description The issue allows a change to a user password without knowing the old password via a crafted POST request. This is due to the mishandling of the ldap bind return valu...