Improper Validation of Password Reset Request in CubeCart 5.2.12 - 5.2.16 and 6.x before 6.0.7

CVE-2015-6928 · MEDIUM Severity

AV:N/AC:M/AU:N/C:P/I:P/A:P

classes/admin.class.php in CubeCart 5.2.12 through 5.2.16 and 6.x before 6.0.7 does not properly validate that a password reset request was made, which allows remote attackers to change the administrator password via a recovery request with a space character in the validate parameter and the administrator email in the email parameter.

Learn more about our Web Application Penetration Testing UK.