CVE-2007-3630

Description

changePW.php in AV Tutorial Script (avtutorial) 1.0 does not require authentication or knowledge of an old password for password changes, which allows remote attackers to change passwords for arbitrary users via a modified password parameter.

References

https://www.exploit-db.com/exploits/4163

https://exchange.xforce.ibmcloud.com/vulnerabilities/35295

http://www.securityfocus.com/bid/24808

http://osvdb.org/42461

http://attrition.org/pipermail/vim/2007-July/001705.html

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

EPSS