CVE-2009-0457 Information

Description

Multiple directory traversal vulnerabilities in AJA Portal 1.2 allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the currentlang parameter to admin/case.php in the (1) Contact_Plus and (2) Reviews modules and (3) the module_name parameter to admin/includes/FANCYNLOptions.php in the Fancy_NewsLetter module.

Reference

http://osvdb.org/51708 http://osvdb.org/51709 http://secunia.com/advisories/33735 http://www.securityfocus.com/bid/33565 https://www.exploit-db.com/exploits/7939