| Package | Affected versions | Patched versions |
|---|---|---|
| webspell | = 4.0= 4.0.2c= 4.01.00= 4.01.01= 4.01.02= 4.1= 4.1.1= 4.1.2= 4.2.0c= 4.2.0d≤ 4.2.0e |
Directory traversal vulnerability in src/func/language.php in webSPELL 4.2.0e and earlier allows remote attackers to include and execute arbitrary local .php files via a .. (dot dot) in a language cookie. NOTE: this can be leveraged for SQL injection by including awards.php.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free