2007-04-30 23:00:00
mitre
PUBLISHED
picture.php in WebSPELL 4.01.02 and earlier allows remote attackers to read arbitrary files via the file parameter.