Description
PM.php in Elite Bulletin Board before 1.0.10 allows remote authenticated users to delete arbitrary PM messages and conduct other attacks via modified id fields.
References
- 37820 vdb-entry
- 25926 third-party-advisory
- elite-pm-data-manipulation(35262) vdb-entry
- http://sourceforge.net/project/shownotes.php?release_id=520558&group_id=175118
- 24763 vdb-entry