Description: rgod has reported a vulnerability in Flyspray, which can be exploited by malicious people to disclose potentially sensitive information and to compromise a vulnerable system.
Input passed to the "adodbpath" parameter in "sql/install-0.9.7.php" isn't properly verified, before it is used to include files. This can be exploited to include arbitrary files from external and local resources. Remote file inclusion is reportedly possible on PHP 5 by hosting the malicious file on a FTP server.
The vulnerability has been reported in version 0.9.7. Prior versions may also be affected.
If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com.
Ideas, suggestions, and other feedback are most welcome.
