AmnPardaz Security Research Team has reported a vulnerability in Web Wiz Rich Text Editor, which can be exploited by malicious people to disclose sensitive information.

Input passed to the "sub" parameter in RTE_file_browser.asp is not properly sanitised before being used to generate directory listings. This can be exploited to display arbitrary directory listings via directory traversal attacks.

The vulnerability is reported in version 4.0. Prior versions may also be affected.

Solution
Update to version 4.01.
Further details available to Secunia VIM customers

Provided and/or discovered by
AmnPardaz Security Research Team

Changelog
Further details available to Secunia VIM customers

Original Advisory
Web Wiz:
http://www.webwizguide.com/webwizrichtexteditor/kb/release_notes.asp

AmnPardaz Security Research Team:
http://www.bugreport.ir/?/31

Deep Links
Links available to Secunia VIM customers