Description
Directory traversal vulnerability in (1) edit_mailtexte.cgi and (2) bestmail.cgi in Cosmoshop 8.11.106 and earlier allows remote administrators to read arbitrary files via ".." sequences in the file parameter.
References
- 20177 third-party-advisory
- cosmoshop-multiple-directory-traversal(26533) vdb-entry
- 25648 vdb-entry
- 919 third-party-advisory
- 20060518 [cosmoshop again] sql injection + view all files as admin user mailing-list
- 25647 vdb-entry