Re: Potential security issue with LedgerSMB (inherited from SL)

["Chris Travers" <..hidden..>]

One more thing--

I think this directory transversal vulnerability would be extremely difficult to exploit in most environments because you could only include files with the same names as the SQL-Ledger/LedgerSMB scripts, though in a shared hosting environment (running SQL-Ledger via a hosting provider) there might be some obvious and serious concerns.  I think the level of this threat ought to be "moderate."

Also note that this does not require authentication to run, but that doing anything interesting with it (i.e. accessing the database) does.

Best Wishes,
Chris Travers