CVE-2006-0203

Published: Jan 13, 2006Modified: Apr 16, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

membership.asp in Mini-Nuke CMS System 1.8.2 and earlier does not verify the old password when changing a password, which allows remote attackers to change the passwords of other members via a lostpassnew action with a modified x parameter.

Affected (1)

Products: Mini Nuke: Cms System

Mini Nuke

1 product

Cms System

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Mini Nuke Cms System	Up to 1.8.2

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (18)

http://archives.neohapsis.com/archives/bugtraq/2006-01/0483.html

Source: cve@mitre.org

ExploitVendor Advisory

http://archives.neohapsis.com/archives/fulldisclosure/2006-01/0437.html

Source: cve@mitre.org

ExploitVendor Advisory

http://archives.neohapsis.com/archives/fulldisclosure/2006-01/0439.html

Source: cve@mitre.org

ExploitVendor Advisory

http://secunia.com/advisories/18439

Source: cve@mitre.org

ExploitVendor Advisory

http://securityreason.com/securityalert/344

Source: cve@mitre.org

http://www.osvdb.org/22385

Source: cve@mitre.org

Exploit

http://www.securityfocus.com/archive/1/421748/100/0/threaded

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2006/0173

Source: cve@mitre.org

Vendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/24101

Source: cve@mitre.org

http://archives.neohapsis.com/archives/bugtraq/2006-01/0483.html