[原文]Unspecified "security leak" vulnerability in Contenido before 4.6.4, when register_globals is on and allow_url_fopen is true, has unspecified impact and attack vectors. NOTE: it is likely that this is a PHP remote file include vulnerability.
Contenido CMS is prone to an unspecified remote command execution vulnerability. This is due to a lack of proper sanitization of user-supplied input.
An attacker can exploit this vulnerability to execute arbitrary commands in the context of the Web server process. This may facilitate a compromise of the underlying system; other attacks are also possible.
It should be notes that the "allow_url_fopen" and "register_globals" PHP variables must be enabled to exploit this vulnerability.
No exploit is required.
The vendor has released version 4.6.4 to address this issue.