CVE-2006-0157

settings.php in Reamday Enterprises Magic News Plus 1.0.3 allows remote attackers to change the administrator password via a change action that specifies identical values for the passwd and admin_password parameters, then declares the new password string in the new_passwd and confirm_passwd parameters.

Score

CVSS 2.0 5.0 Medium

Status

Modified - cve@mitre.org

Published

2006-01-10

Last modified

2024-08-07

Affected products

• Magic News Plus (Reamday Enterprises)

References

• http://downloads.securityfocus.com/vulnerabilities/exploits/MagicNewsPlus-pw-change.pl
• http://secunia.com/advisories/18601
• http://www.securityfocus.com/bid/16182