CVE-2007-0681 profile.php in ExtCalendar 2 and earlier allows remote attackers to change the passwords of arbitrary users without providing the original password, and possibly perform other unauthorized actions, vi...
CriticalCVSS 9.8
EPSS 5.4%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
profile.php in ExtCalendar 2 and earlier allows remote attackers to change the passwords of arbitrary users without providing the original password, and possibly perform other unauthorized actions, via modified values to register.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| extcalendar project extcalendar | <= 2 | No fix listed |
References
- 38130 broken-link vdb-entry
- extcalendar-profile-security-bypass(32035) third-party-advisory vdb-entry
- 3239 exploit third-party-advisory vdb-entry