This host is running XOOPS and is prone to security bypass vulnerability.

Successful exploitation will allow remote attackers to activate their accounts without requiring approval from the administrator. Impact Level: Application.

Upgrade to the XOOPS version 2.4.1 http://www.xoops.org/modules/core/

The flaw exists due to the error in the 'activate.php' script which does not verify the activation type when resending the activation email.

XOOPS version prior to 2.4.1

• http://secunia.com/advisories/37274
• http://www.vupen.com/english/advisories/2009/3256
• http://www.xoops.org/modules/newbb/viewtopic.php?post_id=319132

---

Updated on 2015-03-25