eXtreme Styles mod <= 2.2.1 Multiple Vulnerabilities ==================================================== http://www.phpbbstyles.com/ Description =========== These vulnerabilities could allow an attacker that has gained administrative access view file content on the system. 1. Remote File Content Disclosure ======================= In xs_edit.php, the "edit" request field is not properly sanitized. 2. Full Path Disclosure ======================= In xs_edit.php, the "viewbackup" request field is not properly sanitized. Proof of Concept ================ 1. http://forum/admin/xs_edit.php?edit=../../../../etc/passwd 2. http://forum/admin/xs_edit.php?edit=&viewbackup=1 -------------- http://wtf.bz/
