send_message.php in AeroMail before 1.45 allows remote attackers to read arbitrary files on the server, instead of just uploaded files, via an attachment that modifies the filename to be uploaded.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Aeromail | Aeromail | 1.02 (including) | 1.02 (including) |
| Aeromail | Aeromail | 1.10 (including) | 1.10 (including) |
| Aeromail | Aeromail | 1.20 (including) | 1.20 (including) |
| Aeromail | Aeromail | 1.26 (including) | 1.26 (including) |
| Aeromail | Aeromail | 1.30 (including) | 1.30 (including) |
| Aeromail | Aeromail | 1.40 (including) | 1.40 (including) |