|
Description
|
|
Multiple vulnerabilities were identified in VHCS, which could be exploited by attackers to execute arbitrary scripting code or bypass security restrictions.
The first flaw is due to an input validation error in the login page that does not properly validate input passed to the "username" field, which could be exploited by attackers to cause malicious scripting code to be executed by the user's browser in the security context of an affected Web site.
The second vulnerability is due to an error in the "admin/change_password.php" script that does not validate user's old password before allowing the password to be changed, which could be exploited by attackers to gain unauthorized access to the application.
The third issue is due to an error in the "check_login()" [gui/include/login.php] function, which could be exploited by remote attackers to bypass the authentication procedure and add new admin users via the "admin/add_user.php" script.
The fourth flaw is due to an error in the "gui/admin/add_user.php" script that does not validate user's privileges, which could be exploited by malicious users to bypass security restrictions and add new admin users.
|
