Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
resetpass.php in openInvoice 0.90 beta and earlier allows remote authenticated users to change the passwords of arbitrary users via a modified uid parameter. NOTE: this can be leveraged with a separate vulnerability in auth.php to modify passwords without authentication.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
openInvoice 'resetpass.php'身份认证授权绕过漏洞
Vulnerability Description
openInvoice是一个发票管理小工具，可以根据格式要求定制和打印，并通过邮件自动发送给发票被开具者。 openInvoice 0.90 beta版本及其早期版本的resetpass.php允许远程验证用户可以借助修改过的uid参数，更改任意用户的密码。注意：该漏洞能与auth.php中的一个独立漏洞结合，不需要权限就能更改密码。
CVSS Information
N/A
Vulnerability Type
N/A