Researcher: the_Edit0r Disclosure: BUGTRAQ:20061120 mg.applanix <= 1.3.1 Remote File Include Exploit URL: http://www.securityfocus.com/archive/1/archive/1/452138/100/200/threaded Product URL: http://freshmeat.net/projects/applanix/ The first line of dsp_bookings.php is: require_once( $apx_root_path."act_structs.php" ); - Steve