CVE-2008-6002

Affected product: web-cp 0.5.7. The issue is an absolute path traversal in sendfile.php, exploitable when register_globals is enabled, allowing remote attackers to read arbitrary files via a full pathname in the filelocation parameter. Root cause: lack of input validation for the filelocation par...