CVE-2007-6237
HIGH 9.0EPSS 2.7%
cp.php in DeluxeBB 1.09 does not verify that the membercookie parameter corresponds to the authenticated member during a profile update, which allows remote authenticated users to change the e-mail addresses of arbitrary accounts via a modified membercookie parameter, a different vector than CVE-2006-4078. NOTE: this can be leveraged for administrative access by requesting password-reset e-mail through a lostpw action to misc.php.
- CVSS v2.0 NVD
- 9.0 HIGH
AV:N/AC:L/Au:S/C:C/I:C/A:C - EPSS
- 2.74% chance of exploitation in the next 30 days, 86th percentile
- Published
- 2007-12-04
- Updated
- 2024-08-07