Secunia

Matrix86 has reported two vulnerabilities in the Forum Rank System module for PHP-Fusion, which can be exploited by malicious people to disclose sensitive information.

Input passed to the "settings[locale]" parameter in forum.php and profile.php is not properly verified before being used to include files. This can be exploited to include arbitrary files from local resources via directory traversal attacks and URL-encoded NULL bytes ("%00").

Successful exploitation requires that "register_globals" is enabled and that "magic_quotes_gpc" is disabled.

The vulnerabilities are reported in version 1.00.

Solution
Update to version 1.10.
Further details available in Customer Area

Provided and/or discovered by
Matrix86

Changelog
Further details available in Customer Area

Original Advisory
http://www.securityfocus.com/bid/29077

Deep Links
Links available in Customer Area