Anuko Time Tracker Password Reset leading to Account Takeover

CVE Category Price Severity
CVE-2020-27422 CWE-253 Unknown High
Author Risk Exploitation Type Date
Unknown High Remote 2020-12-10
CVSS:4.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 0.01633 0.28735

CVSS vector description

Our sensors found this exploit at:

Below is a copy:

Anuko Time Tracker Password Reset leading to Account Takeover
#Exploit Title: Anuko Time Tracker - Password Reset Vulnerability leading to Account Takeover
#Date: 2020-11-11
#Exploit Author: Mufaddal Masalawala
#Vendor Homepage:
#Software Link:
#Tested on: Kali Linux 2020.3
#CVE: CVE-2020-27422
#Proof Of Concept:
In Anuko Time Tracker v1.19.23.5311 and prior, the password reset link
emailed to the user doesn't expire once used, hence the attacker could use
the same link to take over the victim's account. An Attacker needs to have
the link for successful exploitation. A malicious user could use the same
password reset link of the victim multiple times to take over the account.
To exploit this vulnerability:

   1. Goto 'Password Reset' module and enter any user's login name
   2. Reset the password using the password reset link received in the email
   3. Use the same link again after resetting the password once
   4. Password is changed again using the previously used link.

Copyright ©2024 Exploitalert.

This information is provided for TESTING and LEGAL RESEARCH purposes only.
All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use and Privacy Policy and Impressum