Description
Directory traversal vulnerability in bestmail_edit.cgi in cosmoshop 8.10.78 and earlier allows remote administrators to read arbitrary files via ".." sequences in the file parameter.
References
- 16625 third-party-advisory
- 20050829 [cosmoshop <= 8.10.78] be the shopadmin in one step mailing-list