Description
Directory traversal vulnerability in download/index.php, and possibly download.php, in threesquared.net (aka Ben Speakman) Php download allows remote attackers to overwrite arbitrary local files via .. (dot dot) sequence in the file parameter.
References
- 21774 third-party-advisory
- phpdownload-index-file-include(28751) vdb-entry
- 20060902 php download local file include mailing-list
- 1528 third-party-advisory
- 19872 vdb-entry
- ADV-2006-3479 vdb-entry