Valerie Holfield has discovered a vulnerability in phpmyfamily, which can be exploited by malicious people to gain edit privileges.

It is possible to be automatically logged in as user "nobody" when clicking to download a document and then leaving the page. This grants the person ability to add people, change information, upload and delete documents and images.

Successful exploitation requires that "register_globals" is enabled.

The vulnerability has been reported in version 1.3.0. Prior versions may also be affected.

Solution
Update to version 1.3.1.
Further details available in Customer Area

Provided and/or discovered by
Valerie Holfield

Original Advisory
http://sourceforge.net/tracker/index.php?func=detail&aid=973962&group_id=110402&atid=656153

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area