G4N0K has reported a vulnerability in PayPal eStores, which can be exploited by malicious people to bypass certain security restrictions.

The vulnerability is caused due to the "admin/settings.php" script improperly checking for a valid session prior to altering settings. This can be exploited to e.g. change the administrator's password via a specially crafted HTTP POST request to the affected script.

Solution
Restrict access to the "admin/" directory.

Provided and/or discovered by
G4N0K

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://milw0rm.com/exploits/7367

Deep Links
Links available to Secunia VIM customers