Bug in PostNuke 0.62, 0.63 and 0.64 (and possibly PHPnuke)

----- IMPACT ----- If an attacker knows the username and userid of a user on a PostNuked system, it is possible to log in as the user without specifying a password. Userid/username is usually available from the Members list. A fix is available at the end of this document. ----- AFFECTED VERSIONS...