|
Vulnerability PHProjekt Affected PHProjekt 2.0, 2.0.1, 2.1 Description PHProjekt is an open source groupware suite written in PHP4 with mysql/postgres/oracle support. The security hole concernes the file module. By adding the famous ".." string to the url one can have access to other directories than the one which is specified in the config. The concerned releases are version 2.0, 2.0.1 and 2.1 of PHProjekt Credit goes to Daniel Wittenberg for founding this. Solution A patched version of the file is available under: http://www.phprojekt.com/download/patch-2.1.tar.gz or download the newest release from the homepage.