Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
cp.php in DeluxeBB 1.09 does not verify that the membercookie parameter corresponds to the authenticated member during a profile update, which allows remote authenticated users to change the e-mail addresses of arbitrary accounts via a modified membercookie parameter, a different vector than CVE-2006-4078. NOTE: this can be leveraged for administrative access by requesting password-reset e-mail through a lostpw action to misc.php.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
DeluxeBB CP.PHP 安全绕过漏洞
Vulnerability Description
DeluxeBB中的cp.php不能确定在一个文件更新中membercookie参数相当于验证会员，远程验证用户可以借助一个修改的membercookie参数改变任意账户的email地址,该漏洞不同于CVE-2006-4078。
CVSS Information
N/A
Vulnerability Type
N/A