SECUNIA ADVISORY ID:
Customer Area (Credentials Required)
A vulnerability has been reported in the Medi-QnA component for
Joomla, which can be exploited by malicious people to disclose
potentially sensitive information.
Input passed to the "controller" parameter in index.php (when
"option" is set to "com_mediqna") is not properly verified before
being used to include files. This can be exploited to include
arbitrary files from local resources via directory traversal attacks
and URL-encoded NULL bytes.
The vulnerability is reported in version 1.1. Other versions may also
Update to version 1.2.
PROVIDED AND/OR DISCOVERED BY: