Some vulnerabilities have been discovered in phpTrafficA, which can be exploited by malicious people to disclose potentially sensitive information.

1) Input passed to the "file" parameter in plotStat.php, plotStatBar.php and plotStatPie.php is not properly verified before being used to include files. This can be exploited to include arbitrary files from local resources.

2) Input passed to the "lang" parameter in banref.php is not properly verified before being used to include files. This can be exploited to include arbitrary files from local resources.

Successful exploitation of vulnerability #2 with arbitrary file extensions requires that "magic_quotes_gpc" is disabled.

The vulnerabilities are confirmed in version 1.4.1. Prior versions may also be affected.

Solution
Update to version 1.4.2.

Provided and/or discovered by
1+2) Hamid Ebadi
1) Reported by the vendor.

Changelog
Further details available in Customer Area

Original Advisory
http://soft.zoneo.net/phpTrafficA/news.php

Deep Links
Links available in Customer Area