A vulnerability was reported in Baal Smart Form. A remote user can gain administrative access to the application.
It is reported that a remote user can exploit a flaw in the 'Admin Change Password' page to change the administrative password and then login with that password to gain administrative access.
A demonstration exploit URL is provided:
http://[target]/baalsmartform/regadmin.php
Impact: A remote user can change the administrative password to an arbitrary value and then login using the new password.
