Directory traversal

Directory traversal vulnerability in config.inc.php in phpAbook 0.8.8b and earlier, when magicquotesgpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the userInfo cookie...

phpAbook 0.8.8b - cookie Local File Inclusion

phpAbook 0.8.8b - cookie Local File Inclusion phpAbook ... 61: if isset$HTTPCOOKIEVARS"userInfo" && $HTTPCOOKIEVARS"userInfo" != "" $userArray = explode" ", $HTTPCOOKIEVARS"userInfo"; $userName = $userArray0; $userID = $userArray1; $userLang = $userArray2;...