EUVD-2008-7152

Malware in sbrugna...

Design/Logic Flaw

Incomplete blacklist vulnerability in include.php in PHPKIT 1.6.1 Release 2 and earlier, with allowurlfopen enabled, allows remote attackers to conduct PHP remote file include attacks via a path parameter that specifies a 1 UNC share or 2 ftps URL, which bypasses the check for "http://", "ftp://"...