SecurityFocus has reported about a vulnerability in admin.php that allows an attacker
to create a superuser or modify existing ones, several solutions have been provided
and i for one will check into them but in the meantime i offer adding to admin.php
after the credits the following:
if(stristr($_SERVER["QUERY_STRING"],'AddAuthor') || stristr($_SERVER["QUERY_STRING"],'UpdateAuthor'))
{
die("Illegal Operation");
}
Neither op should pass through the url anyway so my first choice is to block
them.