Description
siteadmin/useredit.php in AlstraSoft Video Share Enterprise does not check authentication, which allows remote attackers to obtain or modify user information via a direct request.
References
- http://www.alstrasoft.com/videoshare_fix.zip
- alstrasoft-vse-useredit-insecure-permissions(33548) vdb-entry
- 20070710 Vendor ACK: CVE-2007-2017 (AlstraSoft useredit.php auth bypass) mailing-list
- ADV-2007-1331 vdb-entry
- 23409 vdb-entry
- http://pridels0.blogspot.com/2007/03/alstrasoft-video-share-enterprise.html
- 24836 third-party-advisory