CVE-2014-8270
BMC Track-It! 11.3 - Privilege Escalation via Account Name Collision
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2014-8270.
PoCs published by bperry, jhart, including Metasploit module auxiliary/scanner/http/bmc_trackit_passwd_reset.
AI-analyzed exploit summary This Metasploit module exploits an unauthenticated arbitrary password reset vulnerability in BMC TrackIt! 11.3 and prior versions. It allows an attacker to change the password of any domain user, including domain administrators, by abusing the password reset mechanism.
Description
BMC Track-It! 11.3 allows remote attackers to gain privileges and execute arbitrary code by creating an account whose name matches that of a local system account, then performing a password reset.
Exploits (1)
This Metasploit module exploits an unauthenticated arbitrary password reset vulnerability in BMC TrackIt! 11.3 and prior versions. It allows an attacker to change the password of any domain user, including domain administrators, by abusing the password reset mechanism.