Secunia Security Advisory – rgod has discovered a vulnerability in Xoops, which can be exploited by malicious people to disclose sensitive information. Input passed to the xoopsConfig[language] parameter in class/xoopseditor/textarea/editor_registry.php isn’t properly verified, before it is used to include files. This can be exploited to include arbitrary files from local resources. Successful exploitation requires that register_globals is enabled and that magic_quotes_gpc is disabled. The vulnerability has been confirmed in version 2.2.3. Other versions may also be affected.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/41567/sa17573.txt
Source: https://packetstormsecurity.com/files/41567/Secunia-Security-Advisory-17573.html