vulnwire
7.5high

CVE-2008-67521 exploit

adminlogin/password.php in the Twitter Clone (TClone) plugin for ReVou Micro Blogging does not verify the original password before changing…

Published 17 y ago · modified 4 mo ago · JSON

CVSS
7.5
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
6.3%
percentile 94%
Public exploits
1
Exploit-DB

adminlogin/password.php in the Twitter Clone (TClone) plugin for ReVou Micro Blogging does not verify the original password before changing passwords, which allows remote attackers to change the administrator's password and gain privileges via a direct request with modified newpass1 and newpass2 parameters in a Change operation.

Exploit prediction (EPSS)

6.35% probability of exploitation in the next 30 days, higher than 94% of all scored CVEs.

Exploits and detections

  • EDB-7523 ReVou Twitter Clone - Admin Password Change · webapps · 2008-12-19

CVSS scores

Assigned byVersionScoreVector
NVD2.07.5AV:N/AC:L/Au:N/C:P/I:P/A:P

Classification

Weakness
  • CWE-20 Improper Input Validation

References

  • exploit-db.com /exploits/7523 · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • osvdb.org /51705 · vdb-entry, x_refsource_OSVDB, x_transferred
  • securityfocus.com /bid/34851 · vdb-entry, x_refsource_BID, x_transferred
  • secunia.com /advisories/33247 · third-party-advisory, x_refsource_SECUNIA, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.