Total vulnerabilities in the database
src/index.php in WebSPELL 4.01.01 and earlier, when register_globals is enabled, allows remote attackers to bypass authentication and gain sensitive information stored in the database via a modified userID parameter in a write action to admin/database.php.
| Software | From | Fixed in |
|---|---|---|
| webspell / webspell | - | 4.01.01.x |
| webspell / webspell | 4.1 | 4.1.x |
| webspell / webspell | 4.0 | 4.0.x |
| webspell / webspell | 4.1.1 | 4.1.1.x |