On the Secunia.com site today, there's a new vulnerability posted that users of the CodeIgniter framework should pay attention to - a "weakness and directory traversal vulnerability".

Lukasz Pilorz has reported a vulnerability and a weakness in CodeIgniter, which can be exploited by malicious people to disclose sensitive information and conduct cross-site scripting and header injection attacks.

There are two problems that lead to this issue - a non-sanitized input parameter and unsanitized data being passed to the xss_clean function. These issues affect CodeIgniter version 1.5.3 and, as of the time of this post, no update has been made in an official release. It is mentioned, however, that the problem has been fixed in the CVS and is waiting for a release.


Secunia.com: CodeIgniter Weakness and Directory Traversal Vulnerability - Read More...