Exploitation Summary
EIP tracks 1 public exploit for CVE-2009-4929. PoCs published by ThE g0bL!N.
AI-analyzed exploit summary This exploit demonstrates an authentication bypass vulnerability in TotalCalendar 2.4, allowing an attacker to change the admin password without prior authentication. The PoC provides a pre-filled form that submits a password change request directly to the vulnerable endpoint.
Description
admin/manage_users.php in TotalCalendar 2.4 does not require administrative authentication, which allows remote attackers to change arbitrary passwords via the newPW1 and newPW2 parameters.
Exploits (1)
This exploit demonstrates an authentication bypass vulnerability in TotalCalendar 2.4, allowing an attacker to change the admin password without prior authentication. The PoC provides a pre-filled form that submits a password change request directly to the vulnerable endpoint.