Description
Directory traversal vulnerability in resetpw.php in eschew.net phpBannerExchange 2.0 and earlier, and other versions before 2.0 Update 5, allows remote attackers to read arbitrary files via a .. (dot dot) in the email parameter during a "Recover password" operation (recoverpw.php).
References
- 19127 third-party-advisory
- 20060307 phpBannerExchange 2.0 Directory Traversal Vulnerability mailing-list
- ADV-2006-0869 vdb-entry
- http://www.eschew.net/scripts/phpbe/2.0/releasenotes.php
- 23720 vdb-entry
- http://www.h4cky0u.org/advisories/HYSA-2006-004-phpbanner.txt
- 20060307 phpBannerExchange 2.0 Directory Traversal Vulnerability mailing-list
- phpbannerexchange-resetpw-dir-traversal(25071) vdb-entry
- phpbannerexchange-recoverpw-dir-traversal(25080) vdb-entry
- 16996 vdb-entry