11 lines
No EOL
677 B
Text
11 lines
No EOL
677 B
Text
source: https://www.securityfocus.com/bid/12406/info
|
|
|
|
Xoops Incontent module is reported prone to a directory traversal vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied input.
|
|
|
|
A malicious user could issue a request containing directory traversal strings such as '../' to possibly view files outside the server root directory.
|
|
|
|
Incontent version 3.0 is reported to be susceptible to this vulnerability. Other versions may also be affected.
|
|
|
|
http://www.example.com/modules/incontent/index.php?op=aff&option=0&url=../../. ./index.php
|
|
|
|
http://www.example.com/modules/incontent/index.php?op=aff&optio n=0&url=../../../mainfile.php |