CVE-2002-1435 Information

Description

class.atkdateattribute.js.php in Achievo 0.7.0 through 0.9.1 except 0.8.2 allows remote attackers to execute arbitrary PHP code when the ‘allow_url_fopen’ setting is enabled via a URL in the config_atkroot parameter that points to the code.

Reference

http://archives.neohapsis.com/archives/bugtraq/2002-08/0235.html http://www.achievo.org/lists/2002/Aug/msg00092.html http://www.iss.net/security_center/static/9947.php http://www.securityfocus.com/bid/5552 class.atkdateattribute.js.php in Achievo 0.7.0 through 0.9.1 except 0.8.2 allows remote attackers to execute arbitrary PHP code when the ‘allow_url_fopen’ setting is enabled via a URL in the config_atkroot parameter that points to the code.