Description
admin_loader.php in PunBB 1.2.1 allows remote attackers to read arbitrary files via the plugin parameter.
References
- http://www.punbb.org/changelogs/1.2.1_to_1.2.2.txt
- punbb-file-disclosure(19478) vdb-entry
- 14394 third-party-advisory
- 20050224 Multiple vulns in punBB mailing-list
- http://www.punbb.org/download/patch/punbb-1.2.1_to_1.2.2.patch