CVE-2009-0886

Name of the Vulnerable Software and Affected Versions OneOrZero Helpdesk versions 1.6.5.7 and earlier

Description A directory traversal issue exists, allowing remote attackers to read arbitrary files. This is achieved by using a .. (dot dot) in the default language parameter of the "login.php" file.

Recommendations For versions 1.6.5.7 and earlier, as a temporary workaround, consider restricting access to the login.php file until a patch is available. Avoid using the default language parameter in the affected file until the issue is resolved.