CVE-2006-5539

An attacker sends an HTTP request to `login/secure.php` with the `cfg[homepath]` parameter set to a URL pointing to a malicious PHP script hosted on an attacker-controlled server [ref_id=1]. The vulnerable code at line 12 concatenates this value with `$cfgProgDir2` to form `$cfgRealProgDir`, which is then passed to `include()` on line 113 [ref_id=1]. Because the input is not sanitized or restricted, PHP will fetch and execute the remote file, giving the attacker arbitrary code execution on the target server. No authentication is required and the only precondition is that the `allow_url_include` PHP setting is enabled.

No patch is included in the bundle. The advisory does not provide a fix, but the remediation would require validating that `$cfg[homepath]` is a local path (e.g., checking it does not contain `http://` or `ftp://`) and avoiding the use of user-controlled input in file inclusion constructs. Disabling `allow_url_include` in PHP configuration would also prevent this class of remote file inclusion attack.