Description
Directory traversal vulnerability in starnet/editors/htmlarea/popups/images.php in Site@School (S@S) 2.4.02 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the dir parameter.
References
- 20090915 Site@School 2.4.02 and below Multiple remote Command mailing-list
- 2374 exploit
- ADV-2006-3664 vdb-entry
- 21975 third-party-advisory
- 1016887 vdb-entry
- 20053 vdb-entry