Web4Future Portal Solutions arhiva.php dir Parameter Traversal Arbitrary File Access
Remote / Network Access
Loss of Confidentiality
Portal Solutions contains a flaw that allows a remote attacker to list files outside of the web path. The issue is due to the arhiva.php not properly sanitizing user input, specifically traversal style attacks (../../) supplied via the 'dir' variable.
Currently, there are no known upgrades, patches, or workarounds available to correct this issue.