Some vulnerabilities have been reported in Pragyan CMS, which can be exploited by malicious people to disclose sensitive information, compromise a vulnerable system, or conduct SQL injection attacks.

1) Input passed to the "sourceFolder" and "moduleFolder" parameters in cms/modules/form.lib.php and cms/modules/search/search.php is not properly verified before being used to include files. This can be exploited to include arbitrary files from local or external resources.

Successful exploitation of this vulnerability requires that "register_globals" is enabled.

2) Input passed via the "fileget" parameter to index.php is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

Successful exploitation of this vulnerability requires that "magic_quotes_gpc" is disabled.

The vulnerabilities are reported in version 2.6.2 and 2.6.4. Other versions may also be affected.

Solution
The vulnerabilities are fixed in version 3.0 (Pre-Alpha).

Provided and/or discovered by
1) N3TR00T3R and Mr.SeCreT
2) Salvatore Fresta

Changelog
Further details available to Secunia VIM customers

Original Advisory
1) http://milw0rm.com/exploits/6078
2) http://securityreason.com/exploitalert/7121

Salvatore Fresta:
http://www.salvatorefresta.net/files/adv/Pragyan%20CMS%202.6.4%20Multiple%20SQL%20Injection%20Vulnerabilities-22042009.txt

Deep Links
Links available to Secunia VIM customers