Directory traversal vulnerability in pbd_engine.php in Php Blue Dragon 2.9.1 and earlier allows remote attackers to read and execute arbitrary local files via a .. (dot dot) sequence via the phpExt parameter, as demonstrated by executing PHP code in a log file.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Php_blue_dragon | Blue_dragon | platinum_2.8.0 (including) | platinum_2.8.0 (including) |
| Php_blue_dragon | Blue_dragon | platinum_2.9.1 (including) | platinum_2.9.1 (including) |