CVE-2005-0859

CzarNews is affected by a PHP remote file inclusion vulnerability in versions 1.12–1.14 (via tpath to cn_config.php). The CVE-2006-3685 entry explicitly states that an attacker can supply a URL to cn_config.php to execute arbitrary PHP code. The CVE-2005-0859 entry describes a related vector for ...

CVE-2005-0859

PHP remote file inclusion vulnerability in CzarNews 1.13b allows remote attackers to execute arbitrary PHP code via the tpath parameter to 1 headlines.php or 2 news.php. NOTE: some sources have reported the "dir" parameter as being affected; however, this is likely a cut-and-paste error from the...