BorN To K!LL has discovered a vulnerability in the Nuke Mobile Entertainment module for PHP-Nuke, which can be exploited by malicious people to disclose sensitive information.

Input passed to the "module_name" parameter in data/compatible.php is not properly verified before being used to include files. This can be exploited to include arbitrary files from local resources.

Successful exploitation requires that "register_globals" is enabled and "magic_quotes_gpc" is disabled, which are not the values recommended by the PHP-Nuke installer.

Solution
Edit the source code to ensure that input is properly verified.

Provided and/or discovered by
BorN To K!LL

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://milw0rm.com/exploits/4447

Deep Links
Links available to Secunia VIM customers