Description
phpSquidPass before 0.2 uses an incomplete regular expression to find a matching username in its database, which allows remote authenticated attackers to effectively delete other usernames via a short username that matches the end of the targeted username.
References
- phpsquidpass-user-deletion(9417) vdb-entry
- http://sourceforge.net/forum/forum.php?forum_id=188359
- 20020623 phpsquidpass: unauthorized user deleting mailing-list
- 5090 vdb-entry