[Bellardia]

Let me try to rephrase that.
When you submit a post form to admincp it will verify that it was generated from inside the admincp by sending along ADMINHASH as well. Now it won't check to see if the adminhash was sent along as well, so using php or javascript someone could possibly abuse this fact to make you query the admin cp by directing you to a certain page such as http://www.yourforum.com/forum/admin...DeleteAllUsers (although this isn't a real function, its an example) without you knowing, pretty much using your access to the admincp to do whatever they want through you.