Jax Petition 3.06 Book - smileys.php?languagepack Local File Inclusion

2007-01-15T00:00:00
ID EXPLOITPACK:B13D833EED9F31A6A6B14849BACBD4DB
Type exploitpack
Reporter ilker Kandemir
Modified 2007-01-15T00:00:00

Description

Jax Petition 3.06 Book - smileys.php?languagepack Local File Inclusion

                                        
                                            source: https://www.securityfocus.com/bid/22072/info
 
Jax Petitionbook is prone to multiple local file-include vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker can exploit these vulnerabilities using directory-traversal strings to have local script code execute in the context of the application. This may allow the attacker to access sensitive information that may aid in further attacks.
 
These issues affect version 1.0.3.06; other versions may also be vulnerable. 

http://www.example.com/smileys.php?language=../../example_file.xxx%00?