CVE-2009-3149

Directory traversal vulnerability in css/js.php in Elgg 1.5, when magicquotesgpc is disabled, allows remote attackers to read arbitrary files via a .. dot dot in the js parameter. NOTE: some of these details are obtained from third party information...

CVE-2009-3149

CVE-2009-3149 describes a directory traversal in Elgg 1.5, allowing remote read of arbitrary files via a ".." in the js parameter of _css/js.php when magic_quotes_gpc is disabled. Affected software is Elgg 1.5; root cause is insufficient input validation in the js parameter leading to path traver...