Security threat - globals overwrite

[counterpoint]

The question has been raised whether the fix should also be applied to the index.php, index2.php and index3.php files in /administrator. The safe answer is yes. The admin side is less obviously vulnerable, but we cannot be sure it is safe without the fix. Patched copies of the files for Mambo 4.5.2.3 are attached. For other versions, please edit the files using the fix shown below (it is exactly the same as for the user side) either as the first executable statements, or immediately after the define of _VALID_MOS.

PHP Code:

$protects = array('_REQUEST', '_GET', '_POST', '_COOKIE', '_FILES', '_SERVER', '_ENV', 'GLOBALS', '_SESSION');

foreach ($protects as $protect) {
    if ( in_array($protect , array_keys($_REQUEST)) ||
         in_array($protect , array_keys($_GET)) ||
         in_array($protect , array_keys($_POST)) ||
         in_array($protect , array_keys($_COOKIE)) ||
         in_array($protect , array_keys($_FILES))) {
        die("Invalid Request.");
    }
} 


[counterpoint]

Here are the fixed files.