x0kster has reported a vulnerability in Xcms, which can be exploited by malicious people to bypass certain security restrictions.

The vulnerability is caused due to improper authentication in admin/cpass.php and can be exploited to change the administrative password by sending a specially crafted POST request.

The vulnerability is reported in version 1.71. Other versions may also be affected.

Solution
Edit the source code to disable the "update password" functionality in cpass.php.
Further details available to Secunia VIM customers

Provided and/or discovered by
x0kster

Changelog
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers