[原文]Directory traversal vulnerability in Nodez 220.127.116.11 and earlier allows remote attackers to read or include arbitrary PHP files via a .. (dot dot) in the op parameter, as demonstrated by inserting malicious Email parameters into list.gtdat, then accessing list.gtdat using the op parameter.
Nodez index.php op Parameter Traversal Local File Inclusion
Remote / Network Access
Loss of Confidentiality,
Loss of Integrity
Nodez contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to the index.php script not properly sanitizing user input supplied to the 'op' variable. This may allow an attacker to include a file from the local system via traversal type calls (../../) that contains arbitrary commands which will be executed by the vulnerable script.
A remote attacker can inject custom PHP commands by including them in the Email field during new account registration.
Currently, there are no known upgrades, patches, or workarounds available to correct this issue.