Sign up for the ITPro Today newsletter
Stay on top of the IT universe with commentary, news analysis, how-to's, and tips delivered to your inbox daily.
CGI Script Center's Account Manager Allows Elevated Access
The product does not protect against unauthorized users resetting the administrative account password.
ITPro Today Staff
August 22, 2000
1 Min Read
Reported August 23, 2000 by n30
VERSIONS AFFECTED
CGI Script Center's Account Manager - all Lite and Pro versions, and possibly the Enterprise version
DESCRIPTION
Administrative level access can be obtained to the product by overwriting the existing admistrator password by calling a specific URL and passing it the new password.
DEMONSTRATION
The following form (provided by the discoverer) will reset the password to whatever is entered. Note: the form is non-funtional in its current state since no specific URL has been defined in the "action' tag.
To Use Modify Source To Point to amadmin.pl on TARGET Server
mail-me
VENDOR RESPONSE
The problem has been fixed in Lite version 1.04 and Pro version 1.026, available on the vendors Web site.
CREDIT
Discovered by n30
About the Author(s)
You May Also Like
.jpg?width=700&auto=webp&quality=80&disable=upscale)
.jpg?width=700&auto=webp&quality=80&disable=upscale)
