FOROS version 3.2 allows for account compromise by changing the username and forumid in a cookie to someone else's.