cve/cves/2017/CVE-2017-7284.md at main

admin/cve

0 Fork 0

mirror of https://github.com/0xMarcio/cve.git synced 2026-10-23 16:35:19 +00:00

Files

T

0xMarcio f0e5b09dfb Fix PoC discovery scope and source attribution

2026-10-21 18:34:06 +02:00

837 B

Raw Permalink Blame History

CVE-2017-7284

Description

An attacker that has hijacked a Unitrends Enterprise Backup (before 9.1.2) web server session can leverage api/includes/users.php to change the password of the logged in account without knowing the current password. This allows for an account takeover.

POC

Reference

https://rhinosecuritylabs.com/research/remote-code-execution-bug-hunting-chapter-1/

Github

No PoCs found on GitHub currently.

Collections

https://github.com/RhinoSecurityLabs/CVEs/tree/master/CVE-2017-7284

837 B Raw Permalink Blame History