Description
Web Wiz Forums 7.7a uses invalid logic to determine user privileges, which allows remote attackers to (1) block arbitrary IP addresses via pop_up_ip_blocking.asp or (2) modify topics via pop_up_topic_admin.asp.
References
- 1010012 vdb-entry
- 5751 vdb-entry
- 10255 vdb-entry
- webwizforums-popuptopicadmin-modify(16030) vdb-entry
- 11525 third-party-advisory
- 5750 vdb-entry
- webwizforums-unauth-ip-blocking(16031) vdb-entry
- 20040430 Critical bug in Web Wiz Forum mailing-list