Description
Directory traversal vulnerability in index.php in PhpMyFaq 1.5.1 allows remote attackers to read arbitrary files or include arbitrary PHP files via a .. (dot dot) in the LANGCODE parameter, which also allows direct code injection via the User Agent field in a request packet, which can be activated by using LANGCODE to reference the user tracking data file.
Remediation
References
Related Vulnerabilities
WordPress Plugin Stockists Manager for Woocommerce Cross-Site Request Forgery (1.0.2.1)
Atlassian Jira Uncontrolled Search Path Element Vulnerability (CVE-2019-20400)
WordPress Plugin WP-Curriculo Vitae Free Arbitrary File Upload (6.3)
WordPress Ultimate Member Plugin Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2023-31216)