CVE-2017-17097 gps-server.net GPS Tracking Software (self hosted) 2.x has a password reset procedure that immediately resets passwords upon an unauthenticated request, and then sends e-mail with a predictable (date-...
CriticalCVSS 9.8
EPSS 6.9%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
gps-server.net GPS Tracking Software (self hosted) 2.x has a password reset procedure that immediately resets passwords upon an unauthenticated request, and then sends e-mail with a predictable (date-based) password to the admin, which makes it easier for remote attackers to obtain access by predicting this new password. This is related to the use of gmdate for password creation in fn_connect.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| gps-server gps tracking software | = 2.1.1 | No fix listed |
| gps-server gps tracking software | = 2.1.2 | No fix listed |
| gps-server gps tracking software | = 2.1.3 | No fix listed |
| gps-server gps tracking software | = 2.1.4 | No fix listed |
| gps-server gps tracking software | = 2.1.5 | No fix listed |
| gps-server gps tracking software | = 2.1.6 | No fix listed |
| gps-server gps tracking software | = 2.1.7 | No fix listed |
| gps-server gps tracking software | = 2.1.8 | No fix listed |
| gps-server gps tracking software | = 2.1.9 | No fix listed |
| gps-server gps tracking software | = 2.2 | No fix listed |
| gps-server gps tracking software | = 2.2.1 | No fix listed |
| gps-server gps tracking software | = 2.2.2 | No fix listed |
| gps-server gps tracking software | = 2.2.5 | No fix listed |
| gps-server gps tracking software | = 2.2.7 | No fix listed |
| gps-server gps tracking software | = 2.3 | No fix listed |
| gps-server gps tracking software | = 2.3.2 | No fix listed |
| gps-server gps tracking software | = 2.3.5 | No fix listed |
| gps-server gps tracking software | = 2.4 | No fix listed |
| gps-server gps tracking software | = 2.4.5 | No fix listed |
| gps-server gps tracking software | = 2.5 | No fix listed |
| gps-server gps tracking software | = 2.5.5 | No fix listed |
| gps-server gps tracking software | = 2.5.7 | No fix listed |
| gps-server gps tracking software | = 2.5.8 | No fix listed |
| gps-server gps tracking software | = 2.5.9 | No fix listed |
| gps-server gps tracking software | = 2.6 | No fix listed |
Show 8 more
| Product | Affected versions | Fixed in |
|---|---|---|
| gps-server gps tracking software | = 2.7 | No fix listed |
| gps-server gps tracking software | = 2.8 | No fix listed |
| gps-server gps tracking software | = 2.8.5 | No fix listed |
| gps-server gps tracking software | = 2.9 | No fix listed |
| gps-server gps tracking software | = 2.9.1 | No fix listed |
| gps-server gps tracking software | = 2.9.2 | No fix listed |
| gps-server gps tracking software | = 2.9.5 | No fix listed |
| gps-server gps tracking software | = 2.9.6 | No fix listed |
References
- gist.github.com patch third-party-advisory
- s1.gps-server.net release-notes vendor-advisory
- 43431 exploit third-party-advisory vdb-entry