CVE

Id
33030  
CVE No.
CVE-2008-2913  
Status
Candidate  
Description
Directory traversal vulnerability in func.php in Devalcms 1.4a, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the currentpath parameter, in conjunction with certain ... (triple dot) and ..... sequences in the currentfile parameter, to index.php.  
Phase
Assigned (20080630)  
Votes
None (candidate not yet proposed)  
Comments