YesWiki before 4.5.2 allows unauthenticated path traversal via the 'squelette' parameter. An attacker can exploit this to read arbitrary files on the server, like /etc/passwd.
YESWIKI 0.2 is vulnerable to Path Traversal. An attacker can exploit this vulnerability to read sensitive files from the server. This vulnerability exists due to insufficient sanitization of user-supplied input to the 'template' parameter in 'wakka.php' script. An attacker can send a specially crafted HTTP request to the vulnerable script and read sensitive files from the server.
YESWIKI Path Traversal Exploit allows an attacker to download a file from the vulnerable server. The attacker can send a specially crafted HTTP request containing directory traversal strings (e.g. “../”) to the vulnerable server and download any file from the server.
Services By CQR