admin/options.php in Grestul 1.2 does not properly restrict access, which allows remote attackers to bypass authentication and create administrative accounts via a manage_admin action in a direct request.Referenceshttp://secunia.com/advisories/35367https://exchange.xforce.ibmcloud.com/vulnerabilities/50999https://www.exploit-db.com/exploits/8902
