hi Xooby.

This is not a new but a well-known fatal hole

minahito had already warned XF-Section has "$_GET extraction" to ohwada about 3 years ago.
But ohwada had never checked the code, then fatal vulnerability was opened 2006 Spring.

Thus, I insist "Don't install modules made by such authors".



This is a typical and dull "remote code execution".

Protector must have warned "turn allow_url_fopen off" to the administrator.
All Protector can do is just warning.

Or should Protector investigate whether such vulnerable modules are installed?


And you'd better distinct between "hack" and "crack".
"Hacking" never means illegal behaviors.