CVE-2009-1767
admin/edituser.php in 2daybiz Template Monster Clone does not require administrative authentication, which allows remote attackers to modify arbitrary accounts via the (1) loginname, (2) password, (3) email, (4) firstname, or (5) lastname parameter.
- Score
- CVSS 2.0 5.0 Medium
- Status
- Modified - cve@mitre.org
- Published
- 2009-05-22
- Last modified
- 2024-08-07
- Weaknesses
- CWE-264
Affected products
References
- http://secunia.com/advisories/35090
- http://www.securityfocus.com/bid/34977
- https://exchange.xforce.ibmcloud.com/vulnerabilities/50561
- https://www.exploit-db.com/exploits/8691
