Total vulnerabilities in the database
Directory traversal vulnerability in src/func/language.php in webSPELL 4.2.0e and earlier allows remote attackers to include and execute arbitrary local .php files via a .. (dot dot) in a language cookie. NOTE: this can be leveraged for SQL injection by including awards.php.
| Software | From | Fixed in |
|---|---|---|
| webspell / webspell | 4.01.02 | 4.01.02.x |
| webspell / webspell | 4.0.2c | 4.0.2c.x |
| webspell / webspell | 4.1.2 | 4.1.2.x |
| webspell / webspell | 4.2.0d | 4.2.0d.x |
| webspell / webspell | 4.1 | 4.1.x |
| webspell / webspell | 4.0 | 4.0.x |
| webspell / webspell | 4.01.00 | 4.01.00.x |
| webspell / webspell | 4.1.1 | 4.1.1.x |
| webspell / webspell | 4.2.0c | 4.2.0c.x |
| webspell / webspell | 4.01.01 | 4.01.01.x |
| webspell / webspell | - | 4.2.0e.x |