Exploit 1.4.19?

[mahdi1234]

How about this one, do dev know it?

http://www.milw0rm.com/exploits/7909

[Joachim Müller]

Thanks for letting us know - that's a brand-new one. We'll look into this and come up with a resolution as soon as possible.

[Abbas Ali]

I can confirm this exploit. Working for a fix.

The patch given by the reporter unsets all variables which were registered because of register_globals on. I think this is the correct way.

[Joachim Müller]

cpg1.4.20 has just been released, which takes care of the exploit. See corresponding announcement thread cpg1.4.20 Security release - upgrade mandatory!