Paul Craig has reported a vulnerability in Mailworks, which can be exploited by malicious people to bypass the user authentication.

The problem is that the application doesn't verify if a user is logged on. It merely checks if a cookie with the appropriate "uId" and "auth" parameters is set.

Successful exploitation allows a malicious person to log on as any user.

Solution
The vendor has reportedly issued a patch.

Provided and/or discovered by
Paul Craig, Pimp Industries.

Changelog
Further details available in Customer Area

Deep Links
Links available in Customer Area