Description
FormMail.php 5.0, and possibly other versions, allows remote attackers to read arbitrary files via a full pathname in the ar_file (auto-reply) parameter.
References
- 20041231 Jacks FormMail.php remote file access vulnerability mailing-list
- 10815 third-party-advisory
- jack-formmail-arfile-view-files(18724) vdb-entry
- 12145 vdb-entry