CVE-2008-5221

The account_save action in admin/userinfo.php in wPortfolio 0.3 and earlier does not require authentication and does not require knowledge of the original password, which allows remote attackers to change the admin account password via modified password and password_retype parameters.

CVSS v2.0

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

2.55% chance of exploitation in the next 30 days, 84th percentile

Published

2008-11-25

Updated

2024-08-07

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/7170

References

• CVE Record
• NVD entry

Related

• CVE-2008-5220
• CVE-2008-5222
• CVE-2008-5219
• CVE-2008-5223
• CVE-2008-5218
• CVE-2008-5225