CVE-2007-0205: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in admin/skins.php for @lex Guestbook 4.0.2 and earlier allows remote attackers to create files in arbitrary directories via ".." sequences in the 1 ajskin and 2 skinedit parameters. NOTE: this can be leveraged for file inclusion by creating a skin file in the la...