Nortel Networks SRG V16 - 'admin_modules.php?module' Traversal Local File Inclusion

source: https://www.securityfocus.com/bid/30687/info

Navboard is prone to multiple local file-include vulnerabilities and a cross-site scripting vulnerability.

An attacker can exploit the local file-include vulnerability using directory-traversal strings to execute local script code in the context of the application. This may allow the attacker to access sensitive information that may aid in further attacks. Exploits of the cross-site scripting issue may allow the attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Navboard 16 is vulnerable; other versions may also be affected.

http://www.example.com/path/admin_modules.php?module=[LFI]