CVE-2006-4913: Undefined Security Weakness

Directory traversal vulnerability in chat/getStartOptions.php in AlstraSoft E-friends 4.85 allows remote attackers to include arbitrary local files and possibly execute arbitrary code via a .. dot dot sequence and trailing null %00 byte in the lang parameter, as demonstrated by injecting PHP code...