Directory traversal vulnerability in LinPHA 1.0 allows remote attackers to include arbitrary files via .. (dot dot) sequences in the (1) lang parameter in docs/index.php and the language parameter in (2) install/install.php, (3) install/sec_stage_install.php, (4) install/third_stage_install.php, and (5) install/forth_stage_install.php. NOTE: direct static code injection is resultant from this issue, as demonstrated by inserting PHP code into the username, which is inserted into linpha.log, which is accessible from the directory traversal.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Linpha | Linpha | 0.9.0 (including) | 0.9.0 (including) |
| Linpha | Linpha | 0.9.1 (including) | 0.9.1 (including) |
| Linpha | Linpha | 0.9.2 (including) | 0.9.2 (including) |
| Linpha | Linpha | 0.9.3 (including) | 0.9.3 (including) |
| Linpha | Linpha | 0.9.4 (including) | 0.9.4 (including) |
| Linpha | Linpha | 1.0 (including) | 1.0 (including) |