Achievo "debugger.php" Remote File Include

Achievo is a web-based resource-management tool implemented in PHP. The application is exposed to a remote file include issue because it fails to sufficiently sanitize user-supplied input to the "config_atkroot" parameter of the "debugger.php" script. Successfully exploiting this issue may allow an attacker to execute malicious PHP code in the context of the webserver process. Achievo versions earlier than 1.4.0 are affected by this issue.

Ref: http://www.securityfocus.com/bid/36822/

09.44.100 - CVE: Not Available
Platform: Web Application