gps-server.net GPS Tracking Software (self hosted) 2.x has a password reset procedure that immediately resets passwords upon an unauthenticated request, and then sends e-mail with a predictable (date-based) password to the admin, which makes it easier for remote attackers to obtain access by predicting this new password. This is related to the use of gmdate for password creation in fn_connect.php.
References
Link | Resource |
---|---|
https://gist.github.com/pak0s/ea7a80c2614d9cd43cfb8230c65c9fec | Patch Third Party Advisory |
https://s1.gps-server.net/changelog.txt | Release Notes Vendor Advisory |
https://www.exploit-db.com/exploits/43431/ | Exploit Third Party Advisory VDB Entry |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mitre
Published: 2018-01-02T15:00:00
Updated: 2018-01-07T10:57:01
Reserved: 2017-12-03T00:00:00
Link: CVE-2017-17097
JSON object: View
NVD Information
Status : Analyzed
Published: 2018-01-02T15:29:00.293
Modified: 2018-01-18T23:25:24.693
Link: CVE-2017-17097
JSON object: View
Redhat Information
No data.
CWE