CVE-2004-2198 account.asp in DUware DUclassmate 1.0 through 1.1 allows remote attackers to change the passwords for arbitrary users by modifying the MM_recordId parameter on the "My Account" page.
MediumCVSS 6.4
EPSS 6.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
account.asp in DUware DUclassmate 1.0 through 1.1 allows remote attackers to change the passwords for arbitrary users by modifying the MM_recordId parameter on the "My Account" page.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| duware duclassmate | = 1.0 | No fix listed |
| duware duclassmate | = 1.1 | No fix listed |
References
- 10663 vdb-entry
- 11363 exploit vdb-entry
- 1011597 exploit vdb-entry vendor-advisory
- duclassmate-password-modification(17682) vdb-entry