[eddie5659]

Hiya



phpmyfamily is a php-based genealogy Web site builder for all operating systems. phpmyfamily versions 1.3.0 and earlier could allow a remote attacker to bypass authentication, if the register_globals option is enabled. By clicking on a document to download it and then leaving the page, a remote attacker would be logged in as 'nobody', which would allow the attacker to gain unauthorized administrative access to the program.


Platforms Affected:

Simon E Booth: phpmyfamily 1.3.0 and prior
Various: Any operating system Any version

http://xforce.iss.net/xforce/xfdb/16514

Regards

eddie