Description
An issue was discovered in Joomla! 2.5.0 through 3.8.8 before 3.8.9. The autoload code checks classnames to be valid, using the "class_exists" function in PHP. In PHP 5.3, this function validates invalid names as valid, which can result in a Local File Inclusion.
Remediation
References
Related Vulnerabilities
Oracle Application Server CVE-2008-7235 Vulnerability (CVE-2008-7235)
WordPress Plugin WP Silverlight Media Player Cross-Site Scripting (0.8)
WordPress Plugin Database Backup for WordPress Cross-Site Scripting (2.3.3)
WordPress Plugin WP-Live Chat by 3CX Cross-Site Scripting (8.1.9)
Oracle Application Server CVE-2008-2593 Vulnerability (CVE-2008-2593)