2005-11-16 07:37:00
mitre
PUBLISHED
editform.php in w-Agora 4.1.5 allows local users to execute arbitrary PHP code via .. (dot dot) sequences in the file parameter.