Description
UserProfile.cs in Ultraapps Issue Manager before 2.1 allows remote authenticated users to gain administrator privileges by modifying the original (1) p_User_user_id and (2) User_user_id parameters to UserProfile.aspx, then modifying the password field.
References
- 20051220 IRM 013: Ultraapps Issue Manager is vulnerable to Privilege Escalation mailing-list
- ADV-2005-3031 vdb-entry
- 15976 vdb-entry
- http://www.irmplc.com/advisory013.htm
- 18174 third-party-advisory