SecurityInnovation/TMContentReview — Issue #22: Application is Partitioned into Public and Private Domains
Author: SergeTruth
Created: 2011-11-07 22:14:35+00:00
State: open

Problem Example

I don't understand this statement, "Since both data and code is within the same directory, it may be possible for an attacker to gain access to the raw financial data."

Why would "code" be in the same directory as data.

The problem example alludes to another problem related to directory traversal and path manipulation of uploaded and downloaded files. I hope this is covered.