TiGeR-Dz has reported two vulnerabilities in Business Community Script, which can be exploited by malicious people to bypass certain security restrictions, and by malicious users to conduct SQL injection attacks.

1) Access to the admin/adminaddeditdetails.php script is not properly restricted. This can be exploited to e.g. add an administrator user without having administrator credentials.

2) Input passed to the "mid" parameter in admin/member_details.php is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

Solution
Restrict access to the "admin/" directory (via e.g. .htaccess).
Further details available to Secunia VIM customers

Provided and/or discovered by
TiGeR-Dz

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://milw0rm.com/exploits/8689

Deep Links
Links available to Secunia VIM customers