Ulf Harnhammar wrote:
> include("templatedir/$file");
with this you can do
file=../../../../../../../../../../../../../etc/passwd
directory traversal and get any (readable) file from the server.
Not the same vulnerability, but a vulnerability :)
Bye
Gerardo
Received on Sun Mar 20 2005 - 00:58:59 GMT