The remote host is running the Netref directory script, written in PHP. There is a vulnerability in the installed version of Netref that enables a remote attacker to pass arbitrary PHP script code through the 'ad', 'ad_direct', and 'm_for_racine' parameters of the 'cat_for_gen.php' script. This code will be executed on the remote host under the privileges of the web server userid.

Upgrade to Netref 4.3 or later.