Secunia

A vulnerability has been identified in HOLA! cms allowing malicious people to view and edit arbitrary files.

The problem is that the "htmltags.php" script doesn't verify if a user is authenticated before it shows the source of a file, furthermore it allows the user to save the file if the file is writeable. This could be exploited to read the md5 encrypted password, alter the password or insert arbitrary PHP code.

Example:
admin/cms/htmltags.php?datei=./sec/data.php

Solution
Restrict access to the admin directory using .htaccess or similar.

Provided and/or discovered by
Virginity

Deep Links
Links available in Customer Area