CVE-2009-2611

Name of the Vulnerable Software and Affected Versions MyFusion (aka MyF) version 6 Beta

Description A directory traversal issue exists, allowing remote attackers to include and execute arbitrary local files. This is achieved by exploiting the settings[locale] parameter with a .. (dot dot) when register globals is enabled.

Recommendations For MyFusion (aka MyF) version 6 Beta, consider disabling the register globals setting to mitigate the risk of exploitation. Additionally, restrict access to the infusions/last seen users panel/last seen users panel.php file until a patch is available. Avoid using the settings[locale] parameter with untrusted input in the affected file.