Adrian Lamo helps fix HITB security bug

Much love to good-guy hacker (I love that term!), Adrian Lamo for coming forward with information regarding a programming oversight in HITB's Messaging Centre code. The bug creates an arbitary message read vulnerability which would allow for an attacker to read messages outside of his/her inbox. For those of you that have downloaded this code, the bug is on line 205 inside the replyto function. The line should be changed from:

$result = mysql_query("SELECT subject, message FROM messages WHERE id='$id'");

to:
$result = mysql_query("SELECT subject, message FROM messages WHERE id='$id' && uid='$uid'" );

Much thanks once again to Adrian for his help :)