CVE-2008-5221
wportfolio < 0.3 - Unauthenticated Admin Password Change via account_save Action
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2008-5221. PoCs published by G4N0K.
AI-analyzed exploit summary This exploit targets wPortfolio <= 0.3 by changing the admin password via a CSRF attack. It uses base64-encoded PHP to generate a malicious form that submits a new password to the vulnerable application.
Description
The account_save action in admin/userinfo.php in wPortfolio 0.3 and earlier does not require authentication and does not require knowledge of the original password, which allows remote attackers to change the admin account password via modified password and password_retype parameters.
Exploits (1)
This exploit targets wPortfolio <= 0.3 by changing the admin password via a CSRF attack. It uses base64-encoded PHP to generate a malicious form that submits a new password to the vulnerable application.