Description
Directory traversal vulnerability in oc-includes/osclass/controller/ajax.php in OSClass before 3.4.3 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the ajaxfile parameter in a custom action.
Remediation
References
Related Vulnerabilities
WordPress Plugin Enhanced Plugin Admin Cross-Site Scripting (1.15)
Joomla! Core 3.x.x Security Bypass (3.0.0 - 3.2.4)
WordPress Plugin 0mk Shortener Cross-Site Request Forgery (0.2)
WordPress Plugin PowerPress Podcasting by Blubrry Cross-Site Scripting (6.0)
WordPress Plugin Nextend Facebook Connect Unspecified Vulnerability (1.5.7)