CVE-2009-1767 EXPLOIT
5.0
MEDIUM · CVSS 2.0 · EPSS 2.1% (pctl 81)
Patch early
A public exploit exists.
Description
admin/edituser.php in 2daybiz Template Monster Clone does not require administrative authentication, which allows remote attackers to modify arbitrary accounts via the (1) loginname, (2) password, (3) email, (4) firstname, or (5) lastname parameter.
Scoring
| CVSS | 5.0 (MEDIUM, v2.0) |
|---|---|
| Vector | AV:N/AC:L/Au:N/C:N/I:P/A:N |
| EPSS | 2.08% — more likely to be exploited than 81% of all CVEs |
| Weakness | CWE-264 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2009-05-22 |
| Last modified | 2026-06-16 |
Affected (1)
| Vendor | Product |
|---|---|
| 2daybiz | template monster clone |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | 2DayBiz Template Monster Clone - 'edituser.php' Change Pass | 2009-05-14 |
References
- http://secunia.com/advisories/35090
- http://www.securityfocus.com/bid/34977
- https://exchange.xforce.ibmcloud.com/vulnerabilities/50561
- https://www.exploit-db.com/exploits/8691
- http://secunia.com/advisories/35090
- http://www.securityfocus.com/bid/34977
- https://exchange.xforce.ibmcloud.com/vulnerabilities/50561
- https://www.exploit-db.com/exploits/8691
→ the Explorer · watch your stack · NVD