Secunia

ajann has reported a vulnerability in TaskTracker Pro, which can be exploited by malicious people to bypass certain security restrictions.

The vulnerability is caused due to an error in the authentication process within customize.asp. This can be exploited to add arbitrary administrative users via a specially crafted POST request.

The vulnerability is reported in TaskTracker Pro 1.5. Other versions may also be affected.

Solution
Restrict access to the application e.g. with a firewall.

Provided and/or discovered by
ajann

Changelog
Further details available in Customer Area

Original Advisory
http://milw0rm.com/exploits/3068

Deep Links
Links available in Customer Area