CVE-2006-4586
published 2006-09-06CVE-2006-4586: The admin panel in Tr Forum 2.0 accepts a username and password hash for authentication, which allows remote authenticated users to perform unauthorized…
PriorityP431medium5.5CVSS 2.0
AVNACLAuSCPIPAN
EXPLOIT
EPSS
3.09%
86.1th percentile
The admin panel in Tr Forum 2.0 accepts a username and password hash for authentication, which allows remote authenticated users to perform unauthorized actions, as demonstrated by modifying user settings via the id parameter to /membres/modif_profil.php, and changing a password via /membres/change_mdp.php. NOTE: this can be leveraged with other Tr Forum vulnerabilities to allow unauthenticated attackers to gain privileges.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| tr_forum | tr_forum | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No writeups or analysis indexed.
http://acid-root.new.fr/poc/10060903.txthttp://secunia.com/advisories/21754http://securityreason.com/securityalert/1508http://securitytracker.com/id?1016788http://www.osvdb.org/28542http://www.securityfocus.com/archive/1/445079/100/0/threadedhttp://www.securityfocus.com/bid/19834http://www.vupen.com/english/advisories/2006/3452https://exchange.xforce.ibmcloud.com/vulnerabilities/28756https://www.exploit-db.com/exploits/2297http://acid-root.new.fr/poc/10060903.txthttp://secunia.com/advisories/21754http://securityreason.com/securityalert/1508http://securitytracker.com/id?1016788http://www.osvdb.org/28542http://www.securityfocus.com/archive/1/445079/100/0/threadedhttp://www.securityfocus.com/bid/19834http://www.vupen.com/english/advisories/2006/3452https://exchange.xforce.ibmcloud.com/vulnerabilities/28756https://www.exploit-db.com/exploits/2297
2006-09-06
Published