CVE-2007-3630 | BDVDB-2026-25178 Detail

Description#

changePW.php in AV Tutorial Script (avtutorial) 1.0 does not require authentication or knowledge of an old password for password changes, which allows remote attackers to change passwords for arbitrary users via a modified password parameter.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

http://attrition.org/pipermail/vim/2007-July/001705.html
http://www.securityfocus.com/bid/24808
https://exchange.xforce.ibmcloud.com/vulnerabilities/35295
https://www.exploit-db.com/exploits/4163
http://osvdb.org/42461

Exploit#

https://www.exploit-db.com/exploits/4163

History#

Version 12007-07-10Record published in the CVE List.
Version 22024-08-07Most recent update recorded in the CVE List.