[Full-Disclosure] Advisory: Directory traversal in CitrusDB

Advisory: Directory traversal in CitrusDB RedTeam found a directory traversal vulnerability in CitrusDB which results in inclusion of any accessible local .php file. Details ======= Product: CitrusDB Affected Version: 0.3.6, probably = 0.3.5, too Immune Version: none 2005-02-03 OS affected: all...

phplinks2.txt

In-Reply-To: Hi, This is also a php inclusion bug. You can include any .php script on remote system with "PHP Links". Request like this will include script "execute.php" in "/some/some" directory: www.site.com/phplinks/index.php?show=../../../../../../some/some/execute So, if you have FTP access ...