CVE-2007-6237 Auth bypass in n/a

Critical 9.0 Published 4 Dec 2007 Updated 7 Aug 2024

Authenticated users can modify arbitrary account emails via cookie manipulation, enabling password resets and administrative access.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2007-6237?

CVE-2007-6237 is a critical authentication bypass vulnerability in n/a, published on 4 Dec 2007. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

cp.php in DeluxeBB 1.09 does not verify that the membercookie parameter corresponds to the authenticated member during a profile update, which allows remote authenticated users to change the e-mail addresses of arbitrary accounts via a modified membercookie parameter, a different vector than CVE-2006-4078. NOTE: this can be leveraged for administrative access by requesting password-reset e-mail through a lostpw action to misc.php.

Weakness: CWE-287

Which versions are affected by CVE-2007-6237?

It affects 1 product.

Products include Deluxebb Deluxebb.

How do I fix CVE-2007-6237?

No fix has been published for CVE-2007-6237 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2007-6237 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2007-6237 exists.

Public exploit code: 1 Exploit-DB entry.

Sources

Also known as GHSA-qpgw-76q4-xpfv.