Description
The Admin Access With Levels plugin in osCommerce 1.5.1 allows remote attackers to access files in the "admin/" directory by modifying the in_login parameter to a non-zero value.
References
- http://secwatch.org/advisories/1007857
- 11473 third-party-advisory
- 10235 vdb-entry
- 5717 vdb-entry
- oscommerce-plugin-bypass-security(16009) vdb-entry