CVE-2008-1992: Undefined Security Weakness

Acidcat CMS 3.4.1 does not properly restrict access to 1 defaultmailaspemail.asp, 2 defaultmailcdosys.asp or 3 defaultmailjmail.asp, which allows remote attackers to bypass restrictions and relay email messages with modified From, FromName, and To fields...