CVE-2006-6820

Summary

myprofile.asp in Enthrallweb eCoupons does not properly validate the MM_recordId parameter during profile updates, which allows remote authenticated users to modify certain profile fields of another account by specifying that account's username in a modified MM_recordId parameter.

Affected Software

Weaknesses

• n/a

ADP Enrichment

CVE Program Container

Additional References

• http://www.vupen.com/english/advisories/2006/5155
• https://www.exploit-db.com/exploits/2995
• http://secunia.com/advisories/23517
• http://www.securityfocus.com/bid/21739

References

• http://www.vupen.com/english/advisories/2006/5155
• https://www.exploit-db.com/exploits/2995
• http://secunia.com/advisories/23517
• http://www.securityfocus.com/bid/21739

• ←Previous
• Next→