vulnwire
7.5high

CVE-2008-69571 exploit

member.php in Crossday Discuz!

Published 17 y ago · modified 4 mo ago · JSON

CVSS
7.5
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
2.8%
percentile 87%
Public exploits
1
Exploit-DB

member.php in Crossday Discuz! Board allows remote attackers to reset passwords of arbitrary users via crafted (1) lostpasswd and (2) getpasswd actions, possibly involving predictable generation of the id parameter.

Exploit prediction (EPSS)

2.84% probability of exploitation in the next 30 days, higher than 87% of all scored CVEs.

Exploits and detections

  • EDB-7185 Discuz! - Remote Reset User Password · webapps · 2008-11-22

CVSS scores

Assigned byVersionScoreVector
NVD2.07.5AV:N/AC:L/Au:N/C:P/I:P/A:P

Classification

Weakness
  • CWE-264 Permissions, Privileges, and Access Controls

References

  • exploit-db.com /exploits/7185 · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • secunia.com /advisories/32731 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/46785 · vdb-entry, x_refsource_XF, x_transferred
  • discuz.net /archiver/?tid-1112426.html · x_refsource_MISC, x_transferred
  • 80vul.com /dzvul/sodb/14/dz-exp-sodb-2008-14_php.htm · x_refsource_MISC, x_transferred
  • securityfocus.com /bid/32424 · vdb-entry, x_refsource_BID, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.