| Title | Yunzmall <=2.4.2 Arbitrary User Password Reset Vulnerability |
|---|
| Description | YunzMall version ≤2.4.2 has an Arbitrary User Password Reset Vulnerability in the /app/platform/controllers/ResetpwdController.php file, which allows unauthenticated attackers to reset any user's password, including the admin's, by sending a crafted POST request to the /admin/changePwd endpoint. |
|---|
| Source | ⚠️ https://note.zhaoj.in/share/DsijzdQDJSAp |
|---|
| User | glzjin (UID 59815) |
|---|
| Submission | 12/29/2024 14:57 (2 years ago) |
|---|
| Moderation | 01/08/2025 18:04 (10 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 290819 [YunzMall up to 2.4.2 HTTP POST Request ResetpwdController.php changePwd pwd password recovery] |
|---|
| Points | 17 |
|---|