As announced a few days ago, a couple of security flaws have been fixed in The Bug Genie 2.1.2. More information on the fixed flaws are now available as Secunia Advisory SA42081.
We would like to thank Russ McRee and Secunia for bringing these issues to our attention.
The second flaw was with requests not being verified to see if they were actioned by The Bug Genie itself. That means that a link to the user delete page can be disguised as an otherwise harmless link, assuming a user with relevant permissions is logged in. All requests that manipulate data now verify that The Bug Genie initiated the request, by requiring a unique token to be specified in the request (which is also stored in the session), and this token is verified against the session cookie. If there is a difference, then the request is discarded.
Both issues are now fixed and included in the latest release, as previously stated.