Piwio 2.4.6 (install. php) remote reading and deletion of arbitrary files

Piwio 2.4.6 (install. php) Remote Arbitrary File Read/Delete Vulnerability Author: piwio project home page: http://www.piwigo.org impact version: 2.4.6 Test Platform:
Microsoft Windows 7 Ultimate SP1 (EN) Apache 2.4.2 (Win32) PHP 5.4.4 MySQL 5.5.25a Abstract:
Piwio is a photo gallery software for the web that comeswith powerful features to publish and manage your collection ofpictures. Description:
Input passed to the 'dl 'parameter in 'install. php 'scriptis not properly sanitised before being used to get the contents ofa resource or delete files. this can be exploited to read and deletearbitrary data from local resources with the permissions of the webserver via directory traversal attack. ========================================================== ===========================================/install. php: --------------- 113: if (! Empty ($ _ GET ['dl ']) & file_exists (PHPWG_ROOT_PATH. $ conf ['data _ location']. 'pwg _'. $ _ GET ['dl ']) 114: {115: $ filename = PHPWG_ROOT_PATH. $ conf ['data _ location']. 'pwg _'. $ _ GET ['dl ']; 116: header ('cache-Control: no-Cache, must-revalidate'); 117: header ('pragma: no-cache '); 118: header ('content-Disposition: attachment; filename = "database. inc. php "'); 119: header ('content-Transfer-Encoding: bin'); 120: header ('content-Length :'. filesize ($ filename); 121: echo file_get_contents ($ filename); 122: unlink ($ filename); 123: exit (); 124 :} http://www.bkjia.com /Piwio/install. php? Dl =.../../lio_passwords.txt