Info

Last Modified

7 months ago

Percent Complete

25%

Disclosure

Nov 17, 2008

Discovery

Nov 15, 2008

Dates

Exploit

Nov 17, 2008

Solution

Unknown

This Entry needs help! It is only 25% Complete. Click the edit link above to add more information.

Contributing is fast and easy, and benefits the entire security community.

Keywords

Description

(Description Provided by CVE) : The password change feature (admin/cp.php) in VideoScript 4.0.1.50 and earlier does not check for administrative authentication and does not require knowledge of the original password, which allows remote attackers to change the admin account password via modified npass and npass1 parameters.

Classification

Location: Remote/Network Access Required
Attack Type: Authentication Management, Input Manipulation
Impact: Loss of Integrity
Solution: No Solution
Exploit: Exploit Available
Disclosure: Uncoordinated Disclosure
OSVDB: Web Related