Limbo com_fm Component sql.php classes_dir Parameter Remote File Inclusion

The remote host is running Limbo CMS, a content-management system written in PHP. The 'comfm' component of the version of Limbo installed on the remote host allows an unauthenticated, remote attacker to copy arbitrary files, possibly taken from a third-party host, into the web document directory...