I've been alerted to a url hack attempt at my site that I'd like to pass along in case it's potentially serious. I don't run DragonFly or WoWRoster (PostNuke + RosterMaster) but when I follwed the clues it led to a file directory structure that does exist in WoWRoster.

So who should I send the info to and how?

PM the info to me

Done.

I've checked the info. The attack that was attempted here is directory traversal. I've double-checked the code, and there is a limited vulnerability to directory traversal in the attacked code, however it should not be able to be targeted at a random file.

I'll put out a patch for this vulnerability later this afternoon.