Description
Directory traversal vulnerability in the user_get_profile function in include/functions.inc.php in Coppermine Photo Gallery (CPG) 1.4.18 and earlier, when the charset is utf-8, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang part of serialized data in an _data cookie.
Remediation
References
Related Vulnerabilities
phpBB CVE-2008-6507 Vulnerability (CVE-2008-6507)
Apache HTTP Server Cryptographic Issues Vulnerability (CVE-2009-3555)
WordPress Plugin Directories Pro Cross-Site Scripting (1.3.45)
Oracle Database Server CVE-2014-6544 Vulnerability (CVE-2014-6544)
WordPress Plugin JobSearch WP Job Board Security Bypass (1.8.1)