PHPCollab 2.5 Unauthenticated Access

`# Date: 3/5/2012  
# Author: team ' and 1=1--  
# Software Link: http://www.phpcollab.com/  
# Version: 2.5  
# Vulnerability was found during the AthCon IT Security Conference CTF  
#CTF organizer: echothrust  
  
We identified that the PhpCollab application installed under  
http://192.0.0.2/phpcollab/ allows the unauthenticated access of all  
authenticated content. Specifically when requesting a URL that requires  
authentication, such as:  
http://192.0.0.2/phpcollab/clients/listclients.php, the server responds  
with a redirect (location header) to '../index.php?session=false', which  
displays a session error and the login form. However upon inspecting the  
response of the request, we can clearly see that all the application data  
is returned. This issue allows us to access a number of PhpCollab pages  
without any authentication (it must be noted that some of the  
administration pages are not available when exploiting the issue). As an  
example by using the following command an attacker can retrieve the phpinfo  
of the server:  
curl -i http://192.0.0.2/phpcollab/administration/phpinfo.php  
phpinfo reveals that the system is:  
Linux lamp.acmesec.fake 3.1.0-7.fc16.i686.PAE #1 SMP Tue Nov 1 20:53:45 UTC  
2011 i686  
`