GCVE-1988-2026-0193
Vulnerability from gna-1988 – Published: 2026-09-08 07:57 – Updated: 2026-09-08 07:57
VLAI
EPSS
VEX
Title
Weak Password Complexity - elggv6.3.3
Summary
# Exploit Title: Elgg - Lack of Password Complexity
# Date: 1/2026
# Exploit Author: Andrey Stoykov
# Version: 6.3.3
# Tested on: Ubuntu 22.04
# Blog:
https://msecureltd.blogspot.com/2026/01/friday-fun-pentest-series-48-weak.html
// HTTP Request - Changing Password
POST /action/usersettings/save HTTP/1.1
Host: elgg.local
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:148.0)
Gecko/20100101 Firefox/148.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-GB,en;q=0.9
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 216
Origin: http://elgg.local
Sec-GPC: 1
Connection: keep-alive
Referer: http://elgg.local/settings/user/admin
Cookie: Elgg=5ivi0vt1g9jqu1sju70hfnm0mc
Upgrade-Insecure-Requests: 1
Priority: u=0, i
__elgg_token=nIY_M_wh53bUxoHvuKO1YA&__elgg_ts=1769266299&username=admin&name=Admin+User&email_password=&email=
admin () example com
¤t_password=[REDACTED]&password=Passw0rd%21&password2=Passw0rd%21&language=en&guid=46
// HTTP Response - Changing Password
HTTP/1.1 302 Found
Date: Sat, 24 Jan 2026 14:52:07 GMT
Server: Apache/2.4.52 (Ubuntu)
Cache-Control: must-revalidate, no-cache, no-store, private
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
Location: http://elgg.local/settings/user/admin
Vary: User-Agent
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8
Content-Length: 394
<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8" />
<meta http-equiv="refresh" content="0;url='
http://elgg.local/settings/user/admin'"; />
<title>Redirecting to http://elgg.local/settings/user/admin</title>
</head>
<body>
Redirecting to <a href="http://elgg.local/settings/user/admin";>
http://elgg.local/settings/user/admin</a>.
</body>
</html>
// HTTP Request - Changing Password - Following Redirect
GET /settings/user/admin HTTP/1.1
Host: elgg.local
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:148.0)
Gecko/20100101 Firefox/148.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-GB,en;q=0.9
Accept-Encoding: gzip, deflate, br
Origin: http://elgg.local
Sec-GPC: 1
Connection: keep-alive
Referer: http://elgg.local/action/usersettings/save
Cookie: Elgg=5ivi0vt1g9jqu1sju70hfnm0mc
Upgrade-Insecure-Requests: 1
Priority: u=0, i
// HTTP Response - Changing Password - Following Redirect
HTTP/1.1 200 OK
Date: Sat, 24 Jan 2026 14:52:11 GMT
Server: Apache/2.4.52 (Ubuntu)
Cache-Control: must-revalidate, no-cache, no-store, private
x-frame-options: SAMEORIGIN
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
x-content-type-options: nosniff
Vary: Accept-Encoding,User-Agent
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8
Content-Length: 27859
[...]
<div class="elgg-message elgg-message-success"><div class="elgg-inner"><div
class="elgg-body">Password changed</div></div></div>
[...]
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
10 references
Impacted products
1 product
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| unknown | Weak Password Complexity |
Affected:
unknown
|
guessed |
{
"containers": {
"cna": {
"affected": [
{
"product": "Weak Password Complexity",
"vendor": "unknown",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Andrey Stoykov"
}
],
"descriptions": [
{
"lang": "en",
"value": "# Exploit Title: Elgg - Lack of Password Complexity\n# Date: 1/2026\n# Exploit Author: Andrey Stoykov\n# Version: 6.3.3\n# Tested on: Ubuntu 22.04\n# Blog:\nhttps://msecureltd.blogspot.com/2026/01/friday-fun-pentest-series-48-weak.html\n\n// HTTP Request - Changing Password\n\nPOST /action/usersettings/save HTTP/1.1\nHost: elgg.local\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:148.0)\nGecko/20100101 Firefox/148.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language: en-GB,en;q=0.9\nAccept-Encoding: gzip, deflate, br\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 216\nOrigin: http://elgg.local\nSec-GPC: 1\nConnection: keep-alive\nReferer: http://elgg.local/settings/user/admin\nCookie: Elgg=5ivi0vt1g9jqu1sju70hfnm0mc\nUpgrade-Insecure-Requests: 1\nPriority: u=0, i\n\n__elgg_token=nIY_M_wh53bUxoHvuKO1YA\u0026__elgg_ts=1769266299\u0026username=admin\u0026name=Admin+User\u0026email_password=\u0026email=\nadmin () example com\n\u0026current_password=[REDACTED]\u0026password=Passw0rd%21\u0026password2=Passw0rd%21\u0026language=en\u0026guid=46\n\n\n// HTTP Response - Changing Password\n\nHTTP/1.1 302 Found\nDate: Sat, 24 Jan 2026 14:52:07 GMT\nServer: Apache/2.4.52 (Ubuntu)\nCache-Control: must-revalidate, no-cache, no-store, private\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\npragma: no-cache\nLocation: http://elgg.local/settings/user/admin\nVary: User-Agent\nKeep-Alive: timeout=5, max=100\nConnection: Keep-Alive\nContent-Type: text/html; charset=utf-8\nContent-Length: 394\n\n\u003c!DOCTYPE html\u003e\n\u003chtml\u003e\n \u003chead\u003e\n \u003cmeta charset=\"UTF-8\" /\u003e\n \u003cmeta http-equiv=\"refresh\" content=\"0;url=\u0027\nhttp://elgg.local/settings/user/admin\u0027\"; /\u003e\n\n \u003ctitle\u003eRedirecting to http://elgg.local/settings/user/admin\u003c/title\u003e\n \u003c/head\u003e\n \u003cbody\u003e\n Redirecting to \u003ca href=\"http://elgg.local/settings/user/admin\";\u003e\nhttp://elgg.local/settings/user/admin\u003c/a\u003e.\n \u003c/body\u003e\n\u003c/html\u003e\n\n\n// HTTP Request - Changing Password - Following Redirect\n\nGET /settings/user/admin HTTP/1.1\nHost: elgg.local\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:148.0)\nGecko/20100101 Firefox/148.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language: en-GB,en;q=0.9\nAccept-Encoding: gzip, deflate, br\nOrigin: http://elgg.local\nSec-GPC: 1\nConnection: keep-alive\nReferer: http://elgg.local/action/usersettings/save\nCookie: Elgg=5ivi0vt1g9jqu1sju70hfnm0mc\nUpgrade-Insecure-Requests: 1\nPriority: u=0, i\n\n\n\n// HTTP Response - Changing Password - Following Redirect\n\nHTTP/1.1 200 OK\nDate: Sat, 24 Jan 2026 14:52:11 GMT\nServer: Apache/2.4.52 (Ubuntu)\nCache-Control: must-revalidate, no-cache, no-store, private\nx-frame-options: SAMEORIGIN\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\npragma: no-cache\nx-content-type-options: nosniff\nVary: Accept-Encoding,User-Agent\nKeep-Alive: timeout=5, max=100\nConnection: Keep-Alive\nContent-Type: text/html; charset=utf-8\nContent-Length: 27859\n\n[...]\n\u003cdiv class=\"elgg-message elgg-message-success\"\u003e\u003cdiv class=\"elgg-inner\"\u003e\u003cdiv\nclass=\"elgg-body\"\u003ePassword changed\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\n[...]\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T07:57:41Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/29"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Jan/29"
},
{
"url": "http://elgg.local"
},
{
"url": "http://elgg.local/action/usersettings/save"
},
{
"url": "http://elgg.local/settings/user/admin"
},
{
"url": "http://elgg.local/settings/user/admin\""
},
{
"url": "http://elgg.local/settings/user/admin\u0027\""
},
{
"url": "https://msecureltd.blogspot.com/2026/01/friday-fun-pentest-series-48-weak.html"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Jan/29"
],
"discovery": "EXTERNAL"
},
"title": "Weak Password Complexity - elggv6.3.3",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0193",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/29",
"automated": true,
"contentSha256": "18cfea4f759fd84244b618cc40ebf3187468c436649ef826365957fccaee8142",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Jan/29",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-01-24T18:01:43Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-08T07:57:41Z",
"dateUpdated": "2026-09-08T07:57:41Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0193"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…