CVE-2008-5221 | BDVDB-2026-33558 Detail

Description#

The account_save action in admin/userinfo.php in wPortfolio 0.3 and earlier does not require authentication and does not require knowledge of the original password, which allows remote attackers to change the admin account password via modified password and password_retype parameters.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

http://securityreason.com/securityalert/4631
https://www.exploit-db.com/exploits/7170
http://www.vupen.com/english/advisories/2008/3219
https://exchange.xforce.ibmcloud.com/vulnerabilities/46772
http://www.securityfocus.com/bid/32384

Exploit#

https://www.exploit-db.com/exploits/7170

History#

Version 12008-11-25Record published in the CVE List.
Version 22024-08-07Most recent update recorded in the CVE List.