CVE-2018-10519

CMS Made Simple (CMSMS) 2.2.7 contains a privilege-escalation flaw allowing an ordinary user to become admin by configuring the eff_uid value in $_COOKIE[$this->_loginkey] to 1, because files in the tmp/ directory are accessible over HTTP. This vulnerability arises from an incorrect fix for CV...