A vulnerability has been discovered in the RWCards component for Joomla!, which can be exploited by malicious people to disclose sensitive information.

Input passed to the "img" parameter in captcha/captcha_image.php is not properly sanitised before being used. This can be exploited to display arbitrary files via directory traversal attacks and URL-encoded NULL bytes.

Successful exploitation requires that "magic_quotes_gpc" is disabled.

The vulnerability is confirmed in version 3.0.11. Prior versions may also be affected.

Solution
Update to version 3.0.12 or later.

Provided and/or discovered by
Vrs-hCk

Changelog
Further details available in Customer Area

Original Advisory
Vrs-hCk:
http://milw0rm.com/exploits/6817

RWCards:
http://www.weberr.de/index.php?start=28

Deep Links
Links available in Customer Area