SQL-Ledger serious security vulnerability and workaround

Hi;

This post is to inform everyone that there is a serious security hole that has 
been discovered in SQL-Ledger involving session handling.  The flaw allows 
anyone with network access to the server to access the application as any 
logged in user using trivial mechanisms.  I have previously brought this flaw 
up with Dieter several months ago, and since it is still an issue, I have sent 
him a fix that a few of us have prepared.  This fix was prepared by myself and 
Christopher Murtagh with the help of a few testers.

In the mean time, we recommend that people take the following precautions:
1)  DO NOT allow unauthorized users access to the SQL-Ledger application.    
Use .htaccess files or network mechanisms to prevent unauthorized access to the 
application or server.

2)  If different departments require different levels of access, move 
departmental roles into separate applications, and enforce permissions 
accordingly.  The different installations can access the same database, however.

Full disclosure will follow two weeks from yesterday.

Best Wishes,
Chris Travers
Metatron Technology Consulting