Secunia

Stephan Munz has discovered some vulnerabilities in Help Center Live, which can be exploited by malicious people to bypass certain security restrictions.

Various scripts including admin/departments.php and admin/operators.php do not properly restrict access to logged in users and can be exploited with an HTTP client that does not follow redirects.

Successful exploitation allows e.g. deleting administrative users without having valid user credentials.

The vulnerabilities are confirmed in versions 2.1.3a and 2.1.4. Prior versions may also be affected.

Solution
Update to version 2.1.5:
Further details available in Customer Area

Provided and/or discovered by
Stephan Munz

Changelog
Further details available in Customer Area

Deep Links
Links available in Customer Area