I installed this and it seemed to work just great.
Actually it worked perfect!
But, our worst dreams have come true. There is a major security flaw.
If you go on the website and login and then go to /admin you are logged in as admin as a normal user.
From there I was able to access admin functions and look at orders, make product changes... Not good!
ACK!
|