CVE-2012-5242

Name of the Vulnerable Software and Affected Versions Banana Dance versions B.2.6 and earlier

Description The issue allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the name parameter in a "get template" action. This is a directory traversal vulnerability in the functions/suggest.php file.

Recommendations For Banana Dance versions B.2.6 and earlier, consider restricting access to the name parameter in the "get template" action to prevent directory traversal attacks. As a temporary workaround, restrict the use of the name parameter until a patch is available.