iDefense Security Advisory 06.12.07 – Remote exploitation of an input validation error within version 2.1 of YaBB Forum allows attackers to register with forum Administrator privileges. The problem specifically exists due to insufficient validation when writing to the “vars” file for each user. By setting the values of certain variables to contain certain characters, attackers can elevate their privileges to that of the forum Administrator. iDefense confirmed the existence of this vulnerability within version 2.1 of YaBB Forum.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/57167/06.12.07-2.txt
Source: https://packetstormsecurity.com/files/57167/iDEFENSE-Security-Advisory-2007-06-12.2.html