Description
Mevin Productions Basic PHP Events Lister 2.0 does not properly restrict access to (1) admin/reset.php and (2) admin/user_add.php, which allows remote authenticated users to reset administrative passwords or add administrators via a direct request.
References
- 36198 vdb-entry
- 57595 vdb-entry
- 36525 third-party-advisory
- 9558 exploit
- ADV-2009-2497 vdb-entry