ID:3832 - Exploit for Path traversal in Codoforum - CVE-2014-9261

Link to public exploit:

Vulnerability description

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The sanitize function in Codoforum 2.5.1 does not properly implement filtering for directory traversal sequences, which allows remote attackers to read arbitrary files via a .. (dot dot) in the path parameter to index.php.

Remediation