CVE-2006-0203

membership.asp in Mini-Nuke CMS System 1.8.2 and earlier does not verify the old password when changing a password, which allows remote attackers to change the passwords of other members via a lostpassnew action with a modified x parameter.

CVSS v2.0

5.0 MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N

EPSS

2.04% chance of exploitation in the next 30 days, 80th percentile

Published

2006-01-13

Updated

2024-08-07

Proof-of-concept exploits (2)

• http://www.securityfocus.com/archive/1/421748/100/0/threaded
• http://archives.neohapsis.com/archives/fulldisclosure/2006-01/0437.html

References

• CVE Record
• NVD entry

Related

• CVE-2006-0199
• CVE-2006-0204
• CVE-2006-0198
• CVE-2006-0206
• CVE-2006-0194
• CVE-2006-0209