Directory traversal vulnerability in WebCoreModule.ashx in RADactive I-Load before 2008.2.5.0 allows remote attackers to read arbitrary files via unspecified vectors.
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Link | Tags |
---|---|
http://www.securityfocus.com/archive/1/506555/100/0/threaded | mailing list |
http://secunia.com/advisories/23807 | third party advisory vendor advisory |
http://radnet.radactive.com/forum/Default.aspx?g=posts&t=339 | vendor advisory |
https://www.sec-consult.com/files/20090917-0_RADactive_I-Load_Multiple_Vulnerabilities.txt | |
http://www.osvdb.org/58196 | vdb entry |