CVE-2007-5579

login.php in Pligg CMS 9.5 uses a guessable confirmation code when resetting a forgotten password, which allows remote attackers with knowledge of a username to reset that user's password by calculating the confirmationcode parameter.

🔗 References (8)

• cve@mitrehttp://archives.neohapsis.com/archives/bugtraq/2007-05/0383.html
• cve@mitrehttp://osvdb.org/42031
• cve@mitrehttp://www.securityfocus.com/bid/24158
• cve@mitrehttps://exchange.xforce.ibmcloud.com/vulnerabilities/34512
• af854a3a-2127-422b-91ae-364da2661108http://archives.neohapsis.com/archives/bugtraq/2007-05/0383.html
• af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/42031
• af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/24158
• af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/34512