Secunia

Digital Security Research Group has reported a vulnerability in Pixelpost, which can be exploited by malicious people to disclose sensitive information.

Input passed to the "language_full" parameter in index.php is not properly verified before being used to include files. This can be exploited to include arbitrary files from local resources.

Successful exploitation requires that "register_globals" is enabled.

The vulnerability reportedly affects version 1.7.1 on Windows.

Solution
Apply patch.
Further details available in Customer Area

Provided and/or discovered by
Digital Security Research Group

Changelog
Further details available in Customer Area

Original Advisory
Pixelpost:
http://www.pixelpost.org/blog/2008/07/27/pixelpost-171-security-patch/

Digital Security Research Group:
http://www.milw0rm.com/exploits/6150

Deep Links
Links available in Customer Area