CVE-2009-1664 Auth bypass in n/a
Remote attackers can change other users' passwords and gain privileges by bypassing password verification in the account management script.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2009-1664?
CVE-2009-1664 is a high-severity authentication bypass vulnerability in n/a, published on 17 May 2009. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
myaccount.php in Easy Scripts Answer and Question Script does not verify the original password before changing passwords, which allows remote attackers to change the password of other users and gain privileges via modified userid, txtpassword, and txtRpassword parameters.
Weakness: CWE-287
Which versions are affected by CVE-2009-1664?
It affects 1 product.
Products include Easy-Scripts Answer and Question Script.
How do I fix CVE-2009-1664?
No fix has been published for CVE-2009-1664 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2009-1664 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2009-1664 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in n/a
Sources
Also known as GHSA-gc27-xcj8-5jc6.