Horde barcode.php exploit

[SacAutos]

Today I was reviewing my daily watchdog report and saw that a visitor had been able to get a copy of my /etc/passwd file via a horde exploit. After some research I found this old security alert:

http://securityreason.com/securityalert/8077

This is rather old. Why hasn't this been fixed? No wonder I'm seeing ftp login attempts with apparent "insider" knowledge of the user ids...

Plesk 9.5.4 on CentOS 5