Secunia

not sec group has reported a vulnerability in PHP Real Estate Classifieds, which can be exploited by malicious people to disclose sensitive information or to compromise a vulnerable system.

Input passed to the "loc" parameter in admin/header.php is not properly verified before being used to include files. This can be exploited to include arbitrary files from local or external resources.

Successful exploitation requires that "register_globals" is enabled.

Solution
Apply the vendor's security patch:
Further details available in Customer Area

Provided and/or discovered by
not sec group

Changelog
Further details available in Customer Area

Original Advisory
http://milw0rm.com/exploits/4055

Deep Links
Links available in Customer Area