Re: Web Apps- Rad Upload Version 3.02 Remote File Include Vulnerability

[e4c5@xxxxxxxxxxxxxxxx]

1) Obviously the poster is unaware that PHP register_globals have been off for 
a long long time and thus a value of the save_path cannot be passed in through 
the url as described by the poster.
http://au2.php.net/manual/en/security.globals.php

2) He has failed to notice the $save_path is set with in the upload.php script 
and only the website owner can change that.

3) upload.php is not Rad Upload! it's a sample script.