The remote web server contains a PHP application that is prone to remote and local file inclusions attacks. Description : phpMyAgenda is installed on the remote system. It's an open source event management system written in PHP. The application does not sanitize the 'rootagenda' parameter in some of it's files. This allows an attacker to include arbitrary files from remote systems and parse them with privileges of the account under which the web server is started. This vulnerability exists if PHP's 'register_globals' & 'magic_quotes_gpc' are both enabled for the local file inclusions flaw. And if 'allow_url_fopen' is also enabled remote file inclusions are also possible.

No patch information provided at this time. Disable PHP's 'register_globals'

• http://www.securityfocus.com/archive/1/431862/30/0/threaded

---

Updated on 2015-03-25