ThE dE@Th has discovered several vulnerabilities in Kaqoo Auction Software Free Edition, which can be exploited by malicious people to compromise a vulnerable system.

Input passed to the "install_root" parameter in several scripts is not properly verified before being used to include files. This can be exploited to include arbitrary files from local or external resources.

The affected scripts are: categories.inc.php, core/categories.inc.php, core/function.inc.php, core/login.inc.php, core/rdal_object.inc.php, core/request.inc.php, core/support.inc.php, design/form.inc.php, display/activate.inc.php, display/add_bid.inc.php, display/admin_balance.inc.php, display/balance.inc.php, display/buynow.inc.php, display/context_menu.inc.php, display/featured.inc.php, display/fees_info.inc.php, display/install_complete.inc.php, display/item_edit.inc.php, display/item/edit_item.inc.php, display/item/item_info.inc.php, display/item/new_item.inc.php, display/item/preview.inc.php, display/item_repost.inc.php, display/item/save.inc.php, display/items_filter.inc.php, display/leave_feedback.inc.php, display/member.inc.php, display/my_info.inc.php, display/register.inc.php, display/register_success.inc.php, display/search.inc.php, display/user_auctions.inc.php, display/user_feedback.inc.php, display/user.inc.php, display/user_info.inc.php, interfaces.inc.php, left_menu.inc.php, login.inc.php, and processor.inc.php. All scripts are located in the "include/" directory.

Successful exploitation requires that "register_globals" is enabled.

Solution
Edit the source code to ensure that input is properly verified.

Provided and/or discovered by
ThE dE@Th

Changelog
Further details available in Customer Area

Original Advisory
http://milw0rm.com/exploits/3607

Deep Links
Links available in Customer Area