Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
Yet Another Bulletin Board (YaBB) 1.40 and 1.41 does not require a user to submit the correct password before changing it to a new password, which allows remote attackers to modify passwords by stealing the cookie of another user, modifying the expiretime setting, and submitting the change in a profile2 action to index.php.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Yet Another Bulletin Board (YaBB）
Vulnerability Description
Yet Another Bulletin Board (YaBB) 1.40和 1.41版本在更改为新密码之前不需要用户提交正确密码。远程攻击者通过盗用其他用户的cookie，修改expiretime设置以及将profile2作用的改变提交给index.php从而修改密码。
CVSS Information
N/A
Vulnerability Type
N/A