Description
Directory traversal vulnerability in zen/template-functions.php in zenphoto 1.0.4 up to 1.0.6 allows remote attackers to list arbitrary directories via ".." sequences in the album parameter to index.php.
References
- zenphoto-template-directory-traversal(32102) vdb-entry
- 33072 vdb-entry
- http://www.zenphoto.org/support/topic.php?id=1148
- 24026 third-party-advisory
- http://www.zenphoto.org/support/topic.php?id=1146&replies=3
- 22368 vdb-entry
- ADV-2007-0470 vdb-entry