Administrator account creation via registration state injection

Privilege escalation in Joomla! CMS 1.6.x, 1.7.x, and 2.5.0 through 2.5.2 allows remote attackers to create administrator accounts. The registration controller stores every field from a failed submission in session state, and the model later restores an attacker-supplied groups value instead of discarding it. Public self-registration must be enabled; a mismatched-password submission followed by a valid one assigns the new account to the chosen administrative group.