[Zoints]

Here's a troublesome bug. I found today when doing an IP search that some people were showing as having posted under other's IP's, including admin, supermods, and such. I thought there was an exploit until I investigated and found it was a bug with this hack. When merging posts, you use:

$DB_site->query("UPDATE " . TABLE_PREFIX . "post SET pagetext = '" . addslashes($_POST['finalpost']) . "', userid = " . intval($_POST['mergeuser']) . ", title = '" . addslashes(htmlspecialchars_uni($_POST['title'])) . "' WHERE postid = {$vars['newpost']['postid']}");

However, it just updates the userid, but not the username which wreaks all kinds of havok.