CVE-2009-3149

Directory traversal vulnerability in css/js.php in Elgg 1.5, when magicquotesgpc is disabled, allows remote attackers to read arbitrary files via a .. dot dot in the js parameter. NOTE: some of these details are obtained from third party information...

Directory traversal

Directory traversal vulnerability in css/js.php in Elgg 1.5, when magicquotesgpc is disabled, allows remote attackers to read arbitrary files via a .. dot dot in the js parameter. NOTE: some of these details are obtained from third party information...

CVE-2009-3149

CVE-2009-3149 describes a directory traversal in Elgg 1.5, allowing remote read of arbitrary files via a ".." in the js parameter of _css/js.php when magic_quotes_gpc is disabled. Affected software is Elgg 1.5; root cause is insufficient input validation in the js parameter leading to path traver...

CVE-2009-3149

Directory traversal vulnerability in css/js.php in Elgg 1.5, when magicquotesgpc is disabled, allows remote attackers to read arbitrary files via a .. dot dot in the js parameter. NOTE: some of these details are obtained from third party information...

elgg 1.5 Local File Inclusion

Product: elgg.org Version: dbname,$mysqldblink 48: if $simplecacheenabled || $override 49: $filename = $dataroot . 'viewssimplecache/' . md5$viewtype . $view; 51: $contents = filegetcontents$filename; 56: else 59: $contents = elggview$view; /lib/elgglib.php: 237: function elggview$view, .. 317:...