The remote web server contains a PHP script that is prone to directory traversal attacks. Description : The remote host is running RCBlog, a blog written in PHP. The remote version of this software fails to sanitize user-supplied input to the 'post' parameter of the 'index.php' script. An attacker can use this to access arbitrary files on the remote host provided PHP's 'magic_quotes' setting is disabled or, regardless of that setting, files with a '.txt' extension such as those used by the application to store administrative credentials.

Remove the application as its author no longer supports it.

• http://www.securityfocus.com/archive/1/422499

---

Updated on 2015-03-25