jedt/spark_plug — Issue #44: change_password security backdoor
Author: mescalito
Created: 2011-10-19 15:45:55+00:00
State: open

I detected that a registered user (user_group_id = 2) can change the password from another user. This is how:

- On the change_password form there is a hidden input called "data[User][id]"
- If the attacker submits a http form with an id different than its own then the spark_plug will update the database automatically without validation

I suggest that in function change_password() should be a validation before update the database user password, similar like this:

if ($this->data['User']['id'] == $this->Session->read('User.id')){
update Password
}

I hope I explained well and clear
Thanks for the fantastic plugin, I found it amazing and very helpful!