This post originated from an RSS feed registered with PHP Buzz by Forum One. Original Post: Testing script allow_url_fopen + register_globals vulnerability Feed Title: Syntax Framework Feed URL: http://blog.syntaxcms.org/rss.php?version=0.91 Feed Description: Finally, a place to answer Syntax questions Latest PHP Buzz Posts Latest PHP Buzz Posts by Forum One Latest Posts From Syntax Framework

A vulnerability was discovered in SyntaxCMS testing code that can be exploited to include a remote file. If you're site is running with php's register_globals turned on, and allow_url_fopen turned on, with PHP 4.3.0 or later, you may be vulnerable. We've prepared a patch to fix the vulnerability, which you can find here.

If you can't update from CVS or patch your system you can also disable register_globals and allow_url_fopen, delete the public/admin/testing directory, or drop the following .htaccess file into public/admin/testing/tests if you are using Apache:

<Files .php>
    deny from all
</Files>