CVE-2012-1467 Information

Description

Multiple directory traversal vulnerabilities in the iBrowser plugin library as used in Open Journal Systems before 2.3.7 allow remote authenticated users to (1) delete or (2) rename arbitrary files via a .. (dot dot) in the param parameter to lib/pkp/lib/tinymce/jscripts/tiny_mce/plugins/ibrowser/scripts/rfiles.php.

Reference

http://pkp.sfu.ca/support/forum/viewtopic.php?f=2&t=8431 https://www.htbridge.com/advisory/HTB23079