cve/2010/CVE-2010-3272.md

CVE-2010-3272

Description

accounts/ValidateAnswers in the security-questions implementation in ZOHO ManageEngine ADSelfService Plus before 4.5 Build 4500 makes it easier for remote attackers to reset user passwords, and consequently obtain access to arbitrary user accounts, via a modified (1) Hide_Captcha or (2) quesList parameter in a validateAll action.

POC

Reference

• http://securityreason.com/securityalert/8089
• http://www.coresecurity.com/content/zoho-manageengine-vulnerabilities

Github

No PoCs found on GitHub currently.