CVE-2007-3630 changePW.php in AV Tutorial Script (avtutorial) 1.0 does not require authentication or knowledge of an old password for password changes, which allows remote attackers to change passwords for arbitrar...
MediumCVSS 6.4
EPSS 2.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
changePW.php in AV Tutorial Script (avtutorial) 1.0 does not require authentication or knowledge of an old password for password changes, which allows remote attackers to change passwords for arbitrary users via a modified password parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| av scripts av tutorial script | = 1.0 | No fix listed |
References
- 20070710 AVTutorial 1.0 changePW.php vulnerabilities mailing-list
- 42461 vdb-entry
- 24808 vdb-entry
- avtutorialscript-changepw-data-manipulation(35295) vdb-entry
- 4163 exploit