Within phpMyFAQ an input validation problem exists which allows an attacker to include arbitrary local files. With known tricks to inject PHP code into log or session files this could lead to remote PHP code execution. Versions affected are 1.3.12 and below for the stable releases, and 1.4.0-alpha1 and below for the developer releases.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/33374/052004.txt
Source: https://packetstormsecurity.com/files/33374/052004.txt.html