2braincells2go / whizzy Goto Github PK

Exploit:
http://site.org/?[LFI]

Ex:
http://site.org/?../REMOVED../etc/passwd

This needs to be addressed and fixed.

Ignoring is only leaving a bunch of users in danger.

As admin user it is possible to reveal or edit files outside the document root: 
e.g f=../../../etc/passwd&a=e in querystring

In the page editor, try to format a selection with Code from the Character 
pulldown.
OR
In the page editor, try to insert a link using the Link button. The selection 
is deleted and an empty 
link tag is inserted.