search

ksafranski / Fokiz

OSS In-Line PHP Content Management System
Other
44 stars 10 forks source link

Insufficient role authentication #11

Open antirais opened 11 years ago

antirais commented 11 years ago

Logged in user (editor) can change password for other users or delete them.

[Example attacks] http://localhost/system/admin/controllers/password.php POST:p=password&i=<user id>

// Delete user http://localhost/system/admin/controllers/users.php?del=&lt;user id>

evantobin commented 11 years ago

I've submitted the code to fix this...