Description
admin/index.php in AV Arcade 2.1b grants administrative privileges when the ava_userid cookie value is 1, which allows remote attackers to perform certain administrative actions.
References
- 20070702 AV Arcade 2.1b (COOKIE[ava_userid]) Get Admin Rights mailing-list
- 2871 third-party-advisory
- 38952 vdb-entry
- 24736 vdb-entry
- avarcade-avauserid-unauthorized-access(35234) vdb-entry