Описание
profile.php in Simple Customer 1.3 does not require administrative authentication, which allows remote attackers to change the admin e-mail address and password via the email and password parameters.
Ссылки
- Vendor Advisory
- Exploit
- Vendor Advisory
- Exploit
Уязвимые конфигурации
Конфигурация 1
cpe:2.3:a:simplecustomer:simple_customer:1.3:*:*:*:*:*:*:*
EPSS
Процентиль: 87%
0.0347
Низкий
6.4 Medium
CVSS2
Дефекты
CWE-264
Связанные уязвимости
github
почти 4 года назад
profile.php in Simple Customer 1.3 does not require administrative authentication, which allows remote attackers to change the admin e-mail address and password via the email and password parameters.
EPSS
Процентиль: 87%
0.0347
Низкий
6.4 Medium
CVSS2
Дефекты
CWE-264