CVE-2010-0467

Name of the Vulnerable Software and Affected Versions ccNewsletter (com ccnewsletter) version 1.0.5

Description The issue allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter in a ccnewsletter action to "index.php". This is a directory traversal vulnerability.

Recommendations For version 1.0.5, consider restricting access to the vulnerable controller parameter in the ccnewsletter action to minimize the risk of exploitation. As a temporary workaround, avoid using the controller parameter with a .. (dot dot) sequence in the ccnewsletter action until a patch is available.