Direct static code injection vulnerability in error.php in GuppY 4.5.9 and earlier, when register_globals is disabled, allows remote attackers to execute arbitrary PHP code via the _SERVER[REMOTE_ADDR] parameter, which is injected into a .inc script that is later included by the main script.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Guppy | Guppy | 4.5 (including) | 4.5 (including) |
| Guppy | Guppy | 4.5.3 (including) | 4.5.3 (including) |
| Guppy | Guppy | 4.5.3a (including) | 4.5.3a (including) |
| Guppy | Guppy | 4.5.4 (including) | 4.5.4 (including) |
| Guppy | Guppy | 4.5.9 (including) | 4.5.9 (including) |