Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2009-1780: Frax php_recommend lets anyone change password, gain admin
CVE-2009-1780 · published 17 years ago
Summary
The admin.php page in Frax php_recommend versions up to 1.3 does not verify a user’s login when a password change is requested. An attacker can submit forged data to change the password and obtain full administrative rights. Update to a newer version or apply the vendor’s patch and limit access to the admin page.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| frax | php_recommend |
<= 1.3 cpe:2.3:a:frax:php_recommend:*:*:*:*:*:*:*:* |
Original advisory text
admin.php in Frax.dk Php Recommend 1.3 and earlier does not require authentication when the user password is changed, which allows remote attackers to gain administrative privileges via modified fo...
admin.php in Frax.dk Php Recommend 1.3 and earlier does not require authentication when the user password is changed, which allows remote attackers to gain administrative privileges via modified form_admin_user and form_admin_pass parameters.
References
- http://www.securityfocus.com/bid/34909 Exploit Third Party Advisory VDB Entry
- http://www.vupen.com/english/advisories/2009/1287 Permissions Required
- https://www.exploit-db.com/exploits/8658 Exploit Third Party Advisory VDB Entry
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Severity
7.5
High
Type
CWE-306Missing Authentication for Critical Function
Timeline
Published22 May 2009
Updated23 Oct 2026
First seen29 Sep 2026
Sources
CVE-2009-1780 · NVD
Track software like this
Free during beta