Some vulnerabilities have been reported in RTH, which can be exploited by malicious people to conduct SQL injection attacks or to disclose sensitive information.

1) Input passed to the "upload_filename" parameter in download.php is not properly verified before being used to read files. This can be exploited to read arbitrary files from local resources.

2) Input passed via the username to the login page is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

Successful exploitation of the vulnerability requires that "magic_quotes_gpc" is disabled.

The vulnerabilities are reported in versions prior to 1.7.0.

Solution
Update to version 1.7.0.

Provided and/or discovered by
1) Jan Schütze
2) teme7931

Original Advisory
http://sourceforge.net/project/shownotes.php?release_id=618383

http://sourceforge.net/tracker/index.php?func=detail&aid=1896983&group_id=153788&atid=789168
http://sourceforge.net/tracker/index.php?func=detail&aid=1908792&group_id=153788&atid=789168

Deep Links
Links available in Customer Area