Junker Broke has reported a vulnerability in Squirrelmail, which can be exploited by malicious people to disclose certain sensitive information.

Input passed to the "plugins[]" parameter in functions/plugin.php is not properly sanitised before being used to include files. This can be exploited to include arbitrary files from local resources.

Successful exploitation requires that "register_globals" is enabled and "magic_quotes_gpc" is disabled.

The vulnerability has been reported in version 1.4.6 and prior.

Solution
Update to version 1.4.7.
Further details available to Secunia VIM customers

Provided and/or discovered by
Junker Broke

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://www.squirrelmail.org/security/issue/2006-06-01

Deep Links
Links available to Secunia VIM customers