Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
Rock RMS version before 8.6 is vulnerable to account takeover by tampering with the user ID parameter in the profile update feature. The lack of validation and use of sequential user IDs allows any user to change account details of any other user. This vulnerability could be used to change the email address of another account, even the administrator account. Upon changing another account's email address, performing a password reset to the new email address could allow an attacker to take over any account.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Rock RMS 安全漏洞
Vulnerability Description
Rock RMS是一套教堂管理系统。 Rock RMS 8.6之前的版本存在安全漏洞。攻击者很容易通过篡改profile更新中的用户ID参数来接管帐户。由于缺乏验证和连续用户id的使用，任何用户都可以更改任何其他用户的帐户详细信息。这个漏洞可以用来改变另一个帐户的电子邮件地址，甚至是管理员帐户。在更改另一个帐户的电子邮件地址后，对新的电子邮件地址执行密码重置，可以让攻击者接管任何帐户。
CVSS Information
N/A
Vulnerability Type
N/A