Remote file inclusion

PHP remote file inclusion vulnerability in center.php in ProMan 0.1.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the page parameter...

CVE-2010-2137

CVE-2010-2137 describes a PHP remote file inclusion in ProMan 0.1.1 and earlier, where an attacker can cause arbitrary PHP code execution by supplying a URL in the page parameter to _center.php. The vulnerability arises from improper handling of the page parameter, enabling remote code inclusion....

ProMan 0.1.1 - Multiple File Inclusions

ProMan Download: http://sourceforge.net/projects/pman/files/ RFI Code LFI Code includeonce'lang/'.$SESSION'userLang'.'/elisttasks.php'; if !defined'PROMAN' pexit $l'no hack'; PoC RFI: phpRAINCHECKpath/center.php?page=Shell PoC LFI: phpRAINCHECKpath/elisttasks.php?SESSIONuserLang=LFI%00...