The PHP administration script in popper_mod 1.2.1 and earlier relies on Apache .htaccess authentication, which allows remote attackers to gain privileges if the script is not appropriately configured by the administrator.
https://euvd.enisa.europa.eu/vulnerability/EUVD-2002-0509
http://www.symatec-computer.com/forums/viewtopic.php?t=14
http://www.securityfocus.com/bid/4412